curben
/
phishing-filter
mirror of https://gitlab.com/malware-filter/phishing-filter
1
0
Fork 0
Code Issues Releases Wiki Activity
phishing-filter/dist/phishing-filter-snort3.rules

9957 lines
2.2 MiB
Raw Blame History

# Title: Phishing URL Snort3 Ruleset
# Updated: Mon, 15 Nov 2021 00:01:44 +0000
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/
# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"000098.ihostfull.com",nocase; classtype:attempted-recon; sid:200000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"006.zzz.com.ua",nocase; classtype:attempted-recon; sid:200000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0103023segurity.byethost14.com",nocase; classtype:attempted-recon; sid:200000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0145879-pagehelping.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"018740-recoverpage.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"01a2b4b1.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-billing-renewal.com",nocase; classtype:attempted-recon; sid:200000007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-billing-support.org",nocase; classtype:attempted-recon; sid:200000008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-bundle-help.com",nocase; classtype:attempted-recon; sid:200000009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-bundle-renewed.com",nocase; classtype:attempted-recon; sid:200000010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-update-bundle.com",nocase; classtype:attempted-recon; sid:200000011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02bundle-renew.com",nocase; classtype:attempted-recon; sid:200000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"036.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"06btevocale.qlihost.ru",nocase; classtype:attempted-recon; sid:200000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"07dd96.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"08863299.sso-secure-mail0454etr.pages.dev",nocase; classtype:attempted-recon; sid:200000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0bs.de",nocase; classtype:attempted-recon; sid:200000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0c8db53d.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0df72817342afddfdd78c68f7ebdf63678e30cc2.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0pbks8x2ye.bancdeplastiksvhgmcdnlfoesupergiggles.com",nocase; classtype:attempted-recon; sid:200000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0tnr44.stat-pulse.com",nocase; classtype:attempted-recon; sid:200000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0xpnkh.raphitari.com",nocase; classtype:attempted-recon; sid:200000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"101.32.192.174",nocase; classtype:attempted-recon; sid:200000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"102update1.creatorlink.net",nocase; classtype:attempted-recon; sid:200000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"103.114.16.4",nocase; classtype:attempted-recon; sid:200000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.244",nocase; classtype:attempted-recon; sid:200000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.248",nocase; classtype:attempted-recon; sid:200000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104thphoenix.com",nocase; classtype:attempted-recon; sid:200000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"106.12.192.247",nocase; classtype:attempted-recon; sid:200000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"107.172.198.119",nocase; classtype:attempted-recon; sid:200000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"108ideashop.com",nocase; classtype:attempted-recon; sid:200000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"113.125.21.66",nocase; classtype:attempted-recon; sid:200000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"113.164.17.147",nocase; classtype:attempted-recon; sid:200000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"114806303578760.web.id",nocase; classtype:attempted-recon; sid:200000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"119.28.91.122",nocase; classtype:attempted-recon; sid:200000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11bp7.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11dbs.com",nocase; classtype:attempted-recon; sid:200000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11owd.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"121techyard.com",nocase; classtype:attempted-recon; sid:200000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"122.10.99.73",nocase; classtype:attempted-recon; sid:200000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"122.201.23.181",nocase; classtype:attempted-recon; sid:200000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"124.156.136.189",nocase; classtype:attempted-recon; sid:200000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1249d4d7.6u56u665y6h45g45tg3.pages.dev",nocase; classtype:attempted-recon; sid:200000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"124wi.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"127qs.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12a1j.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12fmu.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12jnv.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12lb1.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12lk2.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12mak.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12mo7.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12oei.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12xg1.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"130.211.30.154",nocase; classtype:attempted-recon; sid:200000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"137.184.1.176",nocase; classtype:attempted-recon; sid:200000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"13721372.32304ey.ninishop.org",nocase; classtype:attempted-recon; sid:200000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"14.63.195.13",nocase; classtype:attempted-recon; sid:200000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"140.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"14409-s3-ap--northeast--3-amazonaws-com.translate.goog",nocase; classtype:attempted-recon; sid:200000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"147.139.41.241",nocase; classtype:attempted-recon; sid:200000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.210.143.165",nocase; classtype:attempted-recon; sid:200000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"15004083383734.data-store-company.com",nocase; classtype:attempted-recon; sid:200000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"154.30.211.130.bc.googleusercontent.com",nocase; classtype:attempted-recon; sid:200000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"154.38.114.15",nocase; classtype:attempted-recon; sid:200000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.18",nocase; classtype:attempted-recon; sid:200000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.35",nocase; classtype:attempted-recon; sid:200000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"159.203.115.201",nocase; classtype:attempted-recon; sid:200000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"159.65.133.234",nocase; classtype:attempted-recon; sid:200000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"161.35.142.2",nocase; classtype:attempted-recon; sid:200000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"165.22.103.235",nocase; classtype:attempted-recon; sid:200000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"170.239.84.243",nocase; classtype:attempted-recon; sid:200000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"172.217.21.162",nocase; classtype:attempted-recon; sid:200000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"173.212.239.242",nocase; classtype:attempted-recon; sid:200000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"176.121.14.53",nocase; classtype:attempted-recon; sid:200000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"178-62-213-188.cprapid.com",nocase; classtype:attempted-recon; sid:200000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"178ok.in",nocase; classtype:attempted-recon; sid:200000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"179.43.140.147",nocase; classtype:attempted-recon; sid:200000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"180betper.blogspot.com",nocase; classtype:attempted-recon; sid:200000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.120.7.187",nocase; classtype:attempted-recon; sid:200000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.1",nocase; classtype:attempted-recon; sid:200000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.2",nocase; classtype:attempted-recon; sid:200000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.9",nocase; classtype:attempted-recon; sid:200000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18522-2359.s2.webspace.re",nocase; classtype:attempted-recon; sid:200000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18578-2415.s2.webspace.re",nocase; classtype:attempted-recon; sid:200000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18614247159c.byethost24.com",nocase; classtype:attempted-recon; sid:200000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.225.40.227",nocase; classtype:attempted-recon; sid:200000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188elexusbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"190.115.18.132",nocase; classtype:attempted-recon; sid:200000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"190854.8b.io",nocase; classtype:attempted-recon; sid:200000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"193.135.153.242",nocase; classtype:attempted-recon; sid:200000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1973d320.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1b7d5xw.cn",nocase; classtype:attempted-recon; sid:200000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1dom.club",nocase; classtype:attempted-recon; sid:200000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1fis3j7.cn",nocase; classtype:attempted-recon; sid:200000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1inich.exchange",nocase; classtype:attempted-recon; sid:200000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1m5yp.csb.app",nocase; classtype:attempted-recon; sid:200000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1millionnfts.art",nocase; classtype:attempted-recon; sid:200000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1ncih.exchange",nocase; classtype:attempted-recon; sid:200000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1onlinebancogalicia.vzpla.net",nocase; classtype:attempted-recon; sid:200000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1und1center.tumblr.com",nocase; classtype:attempted-recon; sid:200000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1vtuak.cn",nocase; classtype:attempted-recon; sid:200000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2.136.95.251",nocase; classtype:attempted-recon; sid:200000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20140301.xyz",nocase; classtype:attempted-recon; sid:200000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2021attintellectualproperty.webflow.io",nocase; classtype:attempted-recon; sid:200000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"205.204.101.13",nocase; classtype:attempted-recon; sid:200000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"206.189.85.218",nocase; classtype:attempted-recon; sid:200000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"208.82.115.230",nocase; classtype:attempted-recon; sid:200000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"209.97.188.25",nocase; classtype:attempted-recon; sid:200000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"21234.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"212897764576871473832-dot-bn058.csb.app",nocase; classtype:attempted-recon; sid:200000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"216847071769038.web.id",nocase; classtype:attempted-recon; sid:200000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"217651.8b.io",nocase; classtype:attempted-recon; sid:200000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"222.231.3.128",nocase; classtype:attempted-recon; sid:200000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"222289.ihostfull.com",nocase; classtype:attempted-recon; sid:200000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"23341.ihostfull.com",nocase; classtype:attempted-recon; sid:200000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"234.boyid88784.workers.dev",nocase; classtype:attempted-recon; sid:200000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"23f3d46f.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"245.riliwob272.workers.dev",nocase; classtype:attempted-recon; sid:200000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2482689012.yolasite.com",nocase; classtype:attempted-recon; sid:200000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"24a69f75.orson.website",nocase; classtype:attempted-recon; sid:200000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2524santan-d-er0.hostfree.pw",nocase; classtype:attempted-recon; sid:200000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"25tnr.app.link",nocase; classtype:attempted-recon; sid:200000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"264js.skipdns.link",nocase; classtype:attempted-recon; sid:200000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"299kensingtonroad.my.webex.com",nocase; classtype:attempted-recon; sid:200000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2a8ae0ef.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2fa.bthei.com",nocase; classtype:attempted-recon; sid:200000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2ffth.csb.app",nocase; classtype:attempted-recon; sid:200000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2pil.ru",nocase; classtype:attempted-recon; sid:200000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2qibxad421.site44.com",nocase; classtype:attempted-recon; sid:200000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2qnzq.skipdns.link",nocase; classtype:attempted-recon; sid:200000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2x607mdgo9.escosparz6t9lungula.com",nocase; classtype:attempted-recon; sid:200000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2yoxtja1gg.cuasaighmsgjtrebolar.com",nocase; classtype:attempted-recon; sid:200000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"307592.seu2.cleverreach.com",nocase; classtype:attempted-recon; sid:200000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"30v0jdqba94.typeform.com",nocase; classtype:attempted-recon; sid:200000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"30ywc.codesandbox.io",nocase; classtype:attempted-recon; sid:200000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31.13.71.1",nocase; classtype:attempted-recon; sid:200000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31134.ihostfull.com",nocase; classtype:attempted-recon; sid:200000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31jan.page.link",nocase; classtype:attempted-recon; sid:200000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3212onlineverification.xyz",nocase; classtype:attempted-recon; sid:200000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"32541514546544.hyperphp.com",nocase; classtype:attempted-recon; sid:200000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"331604c4.sibforms.com",nocase; classtype:attempted-recon; sid:200000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3351545445454440.hyperphp.com",nocase; classtype:attempted-recon; sid:200000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"34-125-214-216.cprapid.com",nocase; classtype:attempted-recon; sid:200000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"34-130-46-74.cprapid.com",nocase; classtype:attempted-recon; sid:200000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"34.106.59.172",nocase; classtype:attempted-recon; sid:200000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3456654456765.hyperphp.com",nocase; classtype:attempted-recon; sid:200000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3456765434.hyperphp.com",nocase; classtype:attempted-recon; sid:200000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.186.228.86",nocase; classtype:attempted-recon; sid:200000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.199.84.117",nocase; classtype:attempted-recon; sid:200000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3541164541541445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"362957496159527797431342-2551869538751662180783783.glitch.me",nocase; classtype:attempted-recon; sid:200000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"36t5m.cn",nocase; classtype:attempted-recon; sid:200000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"386f9e87.ithemeshosting.com.php73-39.lan3-1.websitetestlink.com",nocase; classtype:attempted-recon; sid:200000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev",nocase; classtype:attempted-recon; sid:200000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3a49406de08ff312a919-affd9aa46ab2c1ba874fb34fc1659c5d.ssl.cf5.rackcdn.com",nocase; classtype:attempted-recon; sid:200000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ck.me",nocase; classtype:attempted-recon; sid:200000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3dprintersupplies.com.au",nocase; classtype:attempted-recon; sid:200000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3e.ralmakesta.workers.dev",nocase; classtype:attempted-recon; sid:200000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3glite.wapka.co",nocase; classtype:attempted-recon; sid:200000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3j124.csb.app",nocase; classtype:attempted-recon; sid:200000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3jp.moeercarei.com",nocase; classtype:attempted-recon; sid:200000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3name.com",nocase; classtype:attempted-recon; sid:200000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ngq0.skipdns.link",nocase; classtype:attempted-recon; sid:200000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3no.ro",nocase; classtype:attempted-recon; sid:200000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3o2.co",nocase; classtype:attempted-recon; sid:200000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3q3.de",nocase; classtype:attempted-recon; sid:200000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3wondersexpeditions.com",nocase; classtype:attempted-recon; sid:200000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"40.86.206.23",nocase; classtype:attempted-recon; sid:200000173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4115511456415145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"414614415641654.hyperphp.com",nocase; classtype:attempted-recon; sid:200000175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42.193.110.254",nocase; classtype:attempted-recon; sid:200000176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4234655432432gal.eshost.com.ar",nocase; classtype:attempted-recon; sid:200000177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42k8m.skipdns.link",nocase; classtype:attempted-recon; sid:200000178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4404trck.com",nocase; classtype:attempted-recon; sid:200000179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"44514156145145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.236.130.142",nocase; classtype:attempted-recon; sid:200000181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.40.130.40",nocase; classtype:attempted-recon; sid:200000182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.76.76.126",nocase; classtype:attempted-recon; sid:200000183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.95.235.159",nocase; classtype:attempted-recon; sid:200000184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4565434344354.hyperphp.com",nocase; classtype:attempted-recon; sid:200000185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4565465565433.hyperphp.com",nocase; classtype:attempted-recon; sid:200000186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45help43.creatorlink.net",nocase; classtype:attempted-recon; sid:200000187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4666.co.kr",nocase; classtype:attempted-recon; sid:200000188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.99.172.49",nocase; classtype:attempted-recon; sid:200000189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"48tlp.codesandbox.io",nocase; classtype:attempted-recon; sid:200000191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4911806098655919039162338-799207108594095700363930.glitch.me",nocase; classtype:attempted-recon; sid:200000192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4a14def9.sibforms.com",nocase; classtype:attempted-recon; sid:200000193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4jv02.app.link",nocase; classtype:attempted-recon; sid:200000194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4l7rtd.hyperphp.com",nocase; classtype:attempted-recon; sid:200000195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4lxkd.r.ag.d.sendibm3.com",nocase; classtype:attempted-recon; sid:200000196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4pjqi.skipdns.link",nocase; classtype:attempted-recon; sid:200000197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4zwkx.codesandbox.io",nocase; classtype:attempted-recon; sid:200000199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"50.31.88.164",nocase; classtype:attempted-recon; sid:200000200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"50000003794685265.tk",nocase; classtype:attempted-recon; sid:200000201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.222.193.61",nocase; classtype:attempted-recon; sid:200000202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.222.193.66",nocase; classtype:attempted-recon; sid:200000203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.91.122.189",nocase; classtype:attempted-recon; sid:200000204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.fi",nocase; classtype:attempted-recon; sid:200000205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5145365411654.hyperphp.com",nocase; classtype:attempted-recon; sid:200000206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5162346235974523051797845-644834379371670165250764.glitch.me",nocase; classtype:attempted-recon; sid:200000207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5164845456464.hyperphp.com",nocase; classtype:attempted-recon; sid:200000208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"53411545416514.hyperphp.com",nocase; classtype:attempted-recon; sid:200000209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"53secure.ru",nocase; classtype:attempted-recon; sid:200000210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54145451353212.hyperphp.com",nocase; classtype:attempted-recon; sid:200000211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"541512.xyz",nocase; classtype:attempted-recon; sid:200000212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"541514.xyz",nocase; classtype:attempted-recon; sid:200000213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54154514564564.hyperphp.com",nocase; classtype:attempted-recon; sid:200000214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54314324212214.hyperphp.com",nocase; classtype:attempted-recon; sid:200000215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"545415645665145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5454451456445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"545644546451441.hyperphp.com",nocase; classtype:attempted-recon; sid:200000218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5481818174145614.hyperphp.com",nocase; classtype:attempted-recon; sid:200000219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54sadwd.j3byerqkbs.workers.dev",nocase; classtype:attempted-recon; sid:200000220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55454615466641.hyperphp.com",nocase; classtype:attempted-recon; sid:200000221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"556554354654345.hyperphp.com",nocase; classtype:attempted-recon; sid:200000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55bgf.csb.app",nocase; classtype:attempted-recon; sid:200000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55jkomtn2w3.typeform.com",nocase; classtype:attempted-recon; sid:200000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"56146251545.hyperphp.com",nocase; classtype:attempted-recon; sid:200000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5615464545642.hyperphp.com",nocase; classtype:attempted-recon; sid:200000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"565441514551444.hyperphp.com",nocase; classtype:attempted-recon; sid:200000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"56585485485.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"566656565564415.hyperphp.com",nocase; classtype:attempted-recon; sid:200000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"56669663.hyperphp.com",nocase; classtype:attempted-recon; sid:200000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567656474653364.hyperphp.com",nocase; classtype:attempted-recon; sid:200000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567656575654657.hyperphp.com",nocase; classtype:attempted-recon; sid:200000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567765654456.hyperphp.com",nocase; classtype:attempted-recon; sid:200000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5758496488684.hyperphp.com",nocase; classtype:attempted-recon; sid:200000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"57754114545454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"599116.selcdn.ru",nocase; classtype:attempted-recon; sid:200000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5b1kv0.cn",nocase; classtype:attempted-recon; sid:200000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5e841ae2.srvr-cloudmail-srvr6765e7tg.pages.dev",nocase; classtype:attempted-recon; sid:200000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5gg7y.csb.app",nocase; classtype:attempted-recon; sid:200000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5pl.us",nocase; classtype:attempted-recon; sid:200000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5thavegroominglounge.com",nocase; classtype:attempted-recon; sid:200000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5x726-alternate.app.link",nocase; classtype:attempted-recon; sid:200000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5yesplay.com",nocase; classtype:attempted-recon; sid:200000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"600002.selcdn.ru",nocase; classtype:attempted-recon; sid:200000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"603403.selcdn.ru",nocase; classtype:attempted-recon; sid:200000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"605030.selcdn.ru",nocase; classtype:attempted-recon; sid:200000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"607004.selcdn.ru",nocase; classtype:attempted-recon; sid:200000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"60minutesoffame.com",nocase; classtype:attempted-recon; sid:200000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"610508.selcdn.ru",nocase; classtype:attempted-recon; sid:200000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"610926.selcdn.ru",nocase; classtype:attempted-recon; sid:200000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"612507.selcdn.ru",nocase; classtype:attempted-recon; sid:200000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"613622.selcdn.ru",nocase; classtype:attempted-recon; sid:200000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"613706.selcdn.ru",nocase; classtype:attempted-recon; sid:200000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"613707.selcdn.ru",nocase; classtype:attempted-recon; sid:200000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"614807.selcdn.ru",nocase; classtype:attempted-recon; sid:200000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"61da8ae6.6u6566hrrthsh45.pages.dev",nocase; classtype:attempted-recon; sid:200000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"622328.selcdn.ru",nocase; classtype:attempted-recon; sid:200000258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"629afe26.orson.website",nocase; classtype:attempted-recon; sid:200000259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"63454545645454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"650vm.app.link",nocase; classtype:attempted-recon; sid:200000262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"655566564564.hyperphp.com",nocase; classtype:attempted-recon; sid:200000263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6574.ihostfull.com",nocase; classtype:attempted-recon; sid:200000264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"659645dc.sibforms.com",nocase; classtype:attempted-recon; sid:200000265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.42.59.83",nocase; classtype:attempted-recon; sid:200000266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.49.196.115",nocase; classtype:attempted-recon; sid:200000267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6600035.com",nocase; classtype:attempted-recon; sid:200000268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"661544415541455.hyperphp.com",nocase; classtype:attempted-recon; sid:200000269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66448565446564.hyperphp.com",nocase; classtype:attempted-recon; sid:200000270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"67d799f0-7b49-48fb-ac08-8954e4a48b81-a0fe.viosoria-das.ga",nocase; classtype:attempted-recon; sid:200000271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"68.178.252.133",nocase; classtype:attempted-recon; sid:200000272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"688745.hyperphp.com",nocase; classtype:attempted-recon; sid:200000273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"693c4bef.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6b40b612.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6b8c82c6.sibforms.com",nocase; classtype:attempted-recon; sid:200000276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6c7f0acc.sibforms.com",nocase; classtype:attempted-recon; sid:200000277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6e33r.codesandbox.io",nocase; classtype:attempted-recon; sid:200000278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6vvvvvw-metam.top",nocase; classtype:attempted-recon; sid:200000279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"70.40.205.161",nocase; classtype:attempted-recon; sid:200000280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"70.40.208.244",nocase; classtype:attempted-recon; sid:200000281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7002x0788s6.typeform.com",nocase; classtype:attempted-recon; sid:200000282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"739360397.soapcoop.com",nocase; classtype:attempted-recon; sid:200000283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"74728292.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"768675643546534.hyperphp.com",nocase; classtype:attempted-recon; sid:200000285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"768tt.weebly.com",nocase; classtype:attempted-recon; sid:200000286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"779zt.csb.app",nocase; classtype:attempted-recon; sid:200000287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"78.108.89.240",nocase; classtype:attempted-recon; sid:200000288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7a4298b9.sso-mail-secure234ds23d23wd1.pages.dev",nocase; classtype:attempted-recon; sid:200000289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7cbd1cafc8.nxcli.net",nocase; classtype:attempted-recon; sid:200000290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7d54v.app.link",nocase; classtype:attempted-recon; sid:200000291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7jbvtwselm.purycjag99q4ushwayze.com",nocase; classtype:attempted-recon; sid:200000292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7ku50.csb.app",nocase; classtype:attempted-recon; sid:200000293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7p1qy.skipdns.link",nocase; classtype:attempted-recon; sid:200000294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7vu2gw.cn",nocase; classtype:attempted-recon; sid:200000295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7vvvwv-metamas.top",nocase; classtype:attempted-recon; sid:200000296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7wr4u.csb.app",nocase; classtype:attempted-recon; sid:200000297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7yu3v.csb.app",nocase; classtype:attempted-recon; sid:200000298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8.209.76.62",nocase; classtype:attempted-recon; sid:200000299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"800emailsupport.com",nocase; classtype:attempted-recon; sid:200000300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.be",nocase; classtype:attempted-recon; sid:200000301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"81cbfgwh53.extentwulfsaqqehqdwicczanin.com",nocase; classtype:attempted-recon; sid:200000302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"82.165.27.36",nocase; classtype:attempted-recon; sid:200000303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"82d4310c.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"853.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"856966555.hyperphp.com",nocase; classtype:attempted-recon; sid:200000306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"866614545641445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8765423564342.hyperphp.com",nocase; classtype:attempted-recon; sid:200000308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"87656765564534.hyperphp.com",nocase; classtype:attempted-recon; sid:200000309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"88444.ihostfull.com",nocase; classtype:attempted-recon; sid:200000310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8dw5g.codesandbox.io",nocase; classtype:attempted-recon; sid:200000311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8h91i.app.link",nocase; classtype:attempted-recon; sid:200000312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8hsfskj-alternate.app.link",nocase; classtype:attempted-recon; sid:200000313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8y3bmy65yauv.companyaccess.xyz",nocase; classtype:attempted-recon; sid:200000314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"90scds.b-cdn.net",nocase; classtype:attempted-recon; sid:200000315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"91.218.113.78",nocase; classtype:attempted-recon; sid:200000316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"934354637282-343432.com",nocase; classtype:attempted-recon; sid:200000317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"95o68o.cn",nocase; classtype:attempted-recon; sid:200000318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"961c277e.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"96414154511454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"965823.ihostfull.com",nocase; classtype:attempted-recon; sid:200000321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"96968.hyperphp.com",nocase; classtype:attempted-recon; sid:200000322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"969896.ihostfull.com",nocase; classtype:attempted-recon; sid:200000323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"96designersgroup.com",nocase; classtype:attempted-recon; sid:200000324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"98635.ihostfull.com",nocase; classtype:attempted-recon; sid:200000325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99.jarzevokke.workers.dev",nocase; classtype:attempted-recon; sid:200000326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99000.ihostfull.com",nocase; classtype:attempted-recon; sid:200000327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99e4b3f0.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9khnh.app.link",nocase; classtype:attempted-recon; sid:200000330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9xnog.csb.app",nocase; classtype:attempted-recon; sid:200000331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-25ghjud872.byethost13.com",nocase; classtype:attempted-recon; sid:200000332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-25ghjud89.byethost3.com",nocase; classtype:attempted-recon; sid:200000333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a1b40e25.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200000334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a2.betadzoo.com",nocase; classtype:attempted-recon; sid:200000335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a485fc1cde.nxcli.net",nocase; classtype:attempted-recon; sid:200000336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a4d3b42c.chgmar-d8y.pages.dev",nocase; classtype:attempted-recon; sid:200000337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a71843c1.mailssocloud-srvr65e5rd.pages.dev",nocase; classtype:attempted-recon; sid:200000338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aabpjs.covidharsh.com",nocase; classtype:attempted-recon; sid:200000339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aaekt.app.link",nocase; classtype:attempted-recon; sid:200000340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aagamsteelcorporation.com",nocase; classtype:attempted-recon; sid:200000341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aainacreation.co.in",nocase; classtype:attempted-recon; sid:200000342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aaipsds.org",nocase; classtype:attempted-recon; sid:200000343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aalaagroups.com",nocase; classtype:attempted-recon; sid:200000344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aaveswop.com",nocase; classtype:attempted-recon; sid:200000345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ab7553b08e5300472.temporary.link",nocase; classtype:attempted-recon; sid:200000346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abagency.rw",nocase; classtype:attempted-recon; sid:200000347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abamazproduct.net",nocase; classtype:attempted-recon; sid:200000348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abjmjx.covidharsh.com",nocase; classtype:attempted-recon; sid:200000349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abnhvbtufwhtbubtitnwzuxwkagbiu.66ghz.com",nocase; classtype:attempted-recon; sid:200000350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolute-insights.com",nocase; classtype:attempted-recon; sid:200000351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolutepleasure.com.my",nocase; classtype:attempted-recon; sid:200000352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abszolutauto.hu",nocase; classtype:attempted-recon; sid:200000353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abtekdoor.com",nocase; classtype:attempted-recon; sid:200000354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"academiamoviles.com",nocase; classtype:attempted-recon; sid:200000355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acaiconexaoamazoniaitatiba.com.br",nocase; classtype:attempted-recon; sid:200000356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acalanetwork.sale",nocase; classtype:attempted-recon; sid:200000357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accelshare.com",nocase; classtype:attempted-recon; sid:200000358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accept-cnfrmd.rf.gd",nocase; classtype:attempted-recon; sid:200000359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acceptpaiementlbc.com",nocase; classtype:attempted-recon; sid:200000360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accesidca.zyrosite.com",nocase; classtype:attempted-recon; sid:200000361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accesso-clienti.attiva-servizi-2021.com",nocase; classtype:attempted-recon; sid:200000362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account-autentification-instagram-ticket-1000421.1gb.ru",nocase; classtype:attempted-recon; sid:200000363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account-recovery-passwords.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.herephyshy.info",nocase; classtype:attempted-recon; sid:200000365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountactivationuserggh.com.ru",nocase; classtype:attempted-recon; sid:200000366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountliveout.freecluster.eu",nocase; classtype:attempted-recon; sid:200000367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; classtype:attempted-recon; sid:200000368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.itshahi.com",nocase; classtype:attempted-recon; sid:200000369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountverifisv.hostfree.pw",nocase; classtype:attempted-recon; sid:200000370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountverifisv1.hostfree.pw",nocase; classtype:attempted-recon; sid:200000371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountviolation-8uj9.ga",nocase; classtype:attempted-recon; sid:200000372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountviolation-8uj9.tk",nocase; classtype:attempted-recon; sid:200000373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accts-validtion55akda.cf",nocase; classtype:attempted-recon; sid:200000374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accueilserviceactivpluslabanquedsp2-postal.justns.ru",nocase; classtype:attempted-recon; sid:200000375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aceslbc.lbcaceslebon.com",nocase; classtype:attempted-recon; sid:200000376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessobbauto.com",nocase; classtype:attempted-recon; sid:200000377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessobradesco.digital",nocase; classtype:attempted-recon; sid:200000378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessocontalogincef.pt",nocase; classtype:attempted-recon; sid:200000379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessos.clubedebeneficiosbb.com",nocase; classtype:attempted-recon; sid:200000380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"achatlcl60.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200000381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acount090387.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"act67.freecluster.eu",nocase; classtype:attempted-recon; sid:200000383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"action-details.com",nocase; classtype:attempted-recon; sid:200000384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actionnaireparis.zyrosite.com",nocase; classtype:attempted-recon; sid:200000385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activartransferenciainternacional.com",nocase; classtype:attempted-recon; sid:200000386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activate-citi-restore.duckdns.org",nocase; classtype:attempted-recon; sid:200000387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activate-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200000388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activicionrealy.byethost31.com",nocase; classtype:attempted-recon; sid:200000389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activity-of-account.ggoom.shop",nocase; classtype:attempted-recon; sid:200000390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actplan.eu",nocase; classtype:attempted-recon; sid:200000391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acttivvar2909904.hostkda.com",nocase; classtype:attempted-recon; sid:200000392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualbanrservas.eshost.com.ar",nocase; classtype:attempted-recon; sid:200000393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualizaban0954.hostkda.com",nocase; classtype:attempted-recon; sid:200000394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualizaban4568.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actvsanteruy.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acuakpreatpg.rf.gd",nocase; classtype:attempted-recon; sid:200000397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adablysyllenesliopa.com",nocase; classtype:attempted-recon; sid:200000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adamfeber.com",nocase; classtype:attempted-recon; sid:200000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adaptkauai.com",nocase; classtype:attempted-recon; sid:200000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adcloudserver.com",nocase; classtype:attempted-recon; sid:200000401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adds-accnts.rf.gd",nocase; classtype:attempted-recon; sid:200000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adems.co.vu",nocase; classtype:attempted-recon; sid:200000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adityabirla.cam",nocase; classtype:attempted-recon; sid:200000404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adityaschooljabalpur.com",nocase; classtype:attempted-recon; sid:200000405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adjuntarcita.com",nocase; classtype:attempted-recon; sid:200000406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adjuntarcitacr.com",nocase; classtype:attempted-recon; sid:200000407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adjuntarcitascrs.com",nocase; classtype:attempted-recon; sid:200000408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adlxkw.covidharsh.com",nocase; classtype:attempted-recon; sid:200000409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin-formserviceupdates.weeblysite.com",nocase; classtype:attempted-recon; sid:200000410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.baragor.se",nocase; classtype:attempted-recon; sid:200000411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.dreamploy.com",nocase; classtype:attempted-recon; sid:200000412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.indramayukab.go.id",nocase; classtype:attempted-recon; sid:200000413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.sitesumo.com",nocase; classtype:attempted-recon; sid:200000414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adminpostalessl.zyrosite.com",nocase; classtype:attempted-recon; sid:200000415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adpunemploymentclaims.sharefile.com",nocase; classtype:attempted-recon; sid:200000416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ads-google-think.blogspot.com",nocase; classtype:attempted-recon; sid:200000417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adsaccountbusinesscampaigncreditcoupon.com",nocase; classtype:attempted-recon; sid:200000418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adsbusinesscouponcreditcampaign.com",nocase; classtype:attempted-recon; sid:200000419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adscampaignbusinesscreditcoupon.com",nocase; classtype:attempted-recon; sid:200000420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"advent.ist",nocase; classtype:attempted-recon; sid:200000421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adx-exchancesegu2bn-gibcx.com",nocase; classtype:attempted-recon; sid:200000422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ae1ju5.cn",nocase; classtype:attempted-recon; sid:200000423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeboon.xyz",nocase; classtype:attempted-recon; sid:200000424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aemnzsv.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aenderung-online-portal-log.com",nocase; classtype:attempted-recon; sid:200000426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeom-jp.buzz",nocase; classtype:attempted-recon; sid:200000427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aepwfh.covidharsh.com",nocase; classtype:attempted-recon; sid:200000428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aerflofans.com",nocase; classtype:attempted-recon; sid:200000429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aerorescate.co",nocase; classtype:attempted-recon; sid:200000430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aestheticar.com.sg",nocase; classtype:attempted-recon; sid:200000431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afreemart.xyz",nocase; classtype:attempted-recon; sid:200000432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afxdns.covidharsh.com",nocase; classtype:attempted-recon; sid:200000433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ag-hukuk.com",nocase; classtype:attempted-recon; sid:200000434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agewzdw.procreattive.com",nocase; classtype:attempted-recon; sid:200000435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aggiornamento-web.it",nocase; classtype:attempted-recon; sid:200000436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agribisnis.faperta.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricola-avisosx.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolabc.hostfree.pw",nocase; classtype:attempted-recon; sid:200000439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolasvsub.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolaweb.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolbankofi.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolieba800.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agrimetiersmartinique.fr",nocase; classtype:attempted-recon; sid:200000444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aguigom.cl",nocase; classtype:attempted-recon; sid:200000445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agurimu-nagoya.com",nocase; classtype:attempted-recon; sid:200000446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ahaganrtewebb.byethost6.com",nocase; classtype:attempted-recon; sid:200000447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ahmadvipwebhost123v1.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aid-validation-human.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aimekidya-recpag.web.id",nocase; classtype:attempted-recon; sid:200000450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"airdrop-metamask.io",nocase; classtype:attempted-recon; sid:200000451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"airflowsnorkel.net",nocase; classtype:attempted-recon; sid:200000452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ajksahhadhvcc.square.site",nocase; classtype:attempted-recon; sid:200000453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ajudasuporte.brazilsouth.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200000454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ajwd-sa.com",nocase; classtype:attempted-recon; sid:200000455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akanksha3012.github.io",nocase; classtype:attempted-recon; sid:200000456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akdi.auidn.com",nocase; classtype:attempted-recon; sid:200000457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akdi.auidv.com",nocase; classtype:attempted-recon; sid:200000458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akhandayurclinic.com",nocase; classtype:attempted-recon; sid:200000459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aksehirelittotel.com",nocase; classtype:attempted-recon; sid:200000460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualisierung-gmx.yolasite.com",nocase; classtype:attempted-recon; sid:200000461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualisierunggmx.yolasite.com",nocase; classtype:attempted-recon; sid:200000462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualizacja.jst.pl",nocase; classtype:attempted-recon; sid:200000463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alareentading-catalog.page.tl",nocase; classtype:attempted-recon; sid:200000464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"albel.intnet.mu",nocase; classtype:attempted-recon; sid:200000465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alchemistcrm.com",nocase; classtype:attempted-recon; sid:200000466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aldana.in",nocase; classtype:attempted-recon; sid:200000467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerpro191.hostfree.pw",nocase; classtype:attempted-recon; sid:200000468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alertas-lnterbank.com",nocase; classtype:attempted-recon; sid:200000469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerts-payee-new.com",nocase; classtype:attempted-recon; sid:200000470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alertsnet.byethost7.com",nocase; classtype:attempted-recon; sid:200000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfaauv.com",nocase; classtype:attempted-recon; sid:200000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfacomputers.be",nocase; classtype:attempted-recon; sid:200000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfaindustrials.co.uk",nocase; classtype:attempted-recon; sid:200000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfasupport.ru",nocase; classtype:attempted-recon; sid:200000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"algotextil.com.br",nocase; classtype:attempted-recon; sid:200000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alicesecurity.ro",nocase; classtype:attempted-recon; sid:200000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliciabot.azurewebsites.net",nocase; classtype:attempted-recon; sid:200000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alienuniversal-earthassociation.org",nocase; classtype:attempted-recon; sid:200000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkawaterdiy.com",nocase; classtype:attempted-recon; sid:200000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkhalilgraphics.com",nocase; classtype:attempted-recon; sid:200000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkren.pinkmoonltd.com",nocase; classtype:attempted-recon; sid:200000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"all-accountupgrade.weebly.com",nocase; classtype:attempted-recon; sid:200000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allcaredentalcentre.in",nocase; classtype:attempted-recon; sid:200000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro.qumucloud.com",nocase; classtype:attempted-recon; sid:200000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsafe.id-safety.click",nocase; classtype:attempted-recon; sid:200000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsec.id-safety.click",nocase; classtype:attempted-recon; sid:200000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsecure.id-safety.click",nocase; classtype:attempted-recon; sid:200000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-safe.id-safety.click",nocase; classtype:attempted-recon; sid:200000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.125481.space",nocase; classtype:attempted-recon; sid:200000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.230003.space",nocase; classtype:attempted-recon; sid:200000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.45326.pw",nocase; classtype:attempted-recon; sid:200000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.658913.space",nocase; classtype:attempted-recon; sid:200000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.675675.space",nocase; classtype:attempted-recon; sid:200000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.73675.space",nocase; classtype:attempted-recon; sid:200000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.74883.space",nocase; classtype:attempted-recon; sid:200000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.7577341.space",nocase; classtype:attempted-recon; sid:200000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.7843945.space",nocase; classtype:attempted-recon; sid:200000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.98701.space",nocase; classtype:attempted-recon; sid:200000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.translate.goog",nocase; classtype:attempted-recon; sid:200000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allianzbankmypostweb.datlas.it",nocase; classtype:attempted-recon; sid:200000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allweednedislove.byethost6.com",nocase; classtype:attempted-recon; sid:200000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aloenet.cn",nocase; classtype:attempted-recon; sid:200000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alpha-mail-server2.ddns.info",nocase; classtype:attempted-recon; sid:200000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alpus.gppzwz.com",nocase; classtype:attempted-recon; sid:200000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alpus.hlordos.com",nocase; classtype:attempted-recon; sid:200000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alpus.tjdlhs.com",nocase; classtype:attempted-recon; sid:200000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alquileres.com.py",nocase; classtype:attempted-recon; sid:200000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alquilervillora.net",nocase; classtype:attempted-recon; sid:200000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alservic-tirmiles.blogspot.com",nocase; classtype:attempted-recon; sid:200000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alsofft.com",nocase; classtype:attempted-recon; sid:200000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alsope.covidharsh.com",nocase; classtype:attempted-recon; sid:200000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"altami.biz.ua",nocase; classtype:attempted-recon; sid:200000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"although.servebeer.com",nocase; classtype:attempted-recon; sid:200000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumdecor.ru",nocase; classtype:attempted-recon; sid:200000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumnimkn.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check-co-10.rk12.buzz",nocase; classtype:attempted-recon; sid:200000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaazon.co.jp.dulxcr.cn",nocase; classtype:attempted-recon; sid:200000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaczon.co.jp.accountmyamzo.shop",nocase; classtype:attempted-recon; sid:200000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaguo.rbktj2r.top",nocase; classtype:attempted-recon; sid:200000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-updata.inqqyl.ga",nocase; classtype:attempted-recon; sid:200000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-updata.pdjewk.ga",nocase; classtype:attempted-recon; sid:200000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-updata.vgkhtp.ga",nocase; classtype:attempted-recon; sid:200000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amama.twaeimqu.cn",nocase; classtype:attempted-recon; sid:200000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaniip.com",nocase; classtype:attempted-recon; sid:200000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanoc.agrbg6t.xyz",nocase; classtype:attempted-recon; sid:200000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanoe.abtj4hr.top",nocase; classtype:attempted-recon; sid:200000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanuc.kelgr8ij.top",nocase; classtype:attempted-recon; sid:200000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzn.co.jp.ocxybad.cn",nocase; classtype:attempted-recon; sid:200000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzn.co.jp.ov2nvh6.cn",nocase; classtype:attempted-recon; sid:200000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.dalaoshu.com.cn",nocase; classtype:attempted-recon; sid:200000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.dataozi.com.cn",nocase; classtype:attempted-recon; sid:200000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.daxueli.com.cn",nocase; classtype:attempted-recon; sid:200000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.dayouzi.com.cn",nocase; classtype:attempted-recon; sid:200000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.dongyingsd.com.cn",nocase; classtype:attempted-recon; sid:200000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.gjliuxue.com.cn",nocase; classtype:attempted-recon; sid:200000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.hualuobo.com.cn",nocase; classtype:attempted-recon; sid:200000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.hz-lfy.com.cn",nocase; classtype:attempted-recon; sid:200000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.hzsdxhgz.com.cn",nocase; classtype:attempted-recon; sid:200000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.jiqingjf.com.cn",nocase; classtype:attempted-recon; sid:200000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.juliangzhixue.com.cn",nocase; classtype:attempted-recon; sid:200000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.lingjunet.com.cn",nocase; classtype:attempted-recon; sid:200000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.qibeipay.com.cn",nocase; classtype:attempted-recon; sid:200000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.richangyuansu.com.cn",nocase; classtype:attempted-recon; sid:200000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.spencerobinson.com.cn",nocase; classtype:attempted-recon; sid:200000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.zhanjianghk.com.cn",nocase; classtype:attempted-recon; sid:200000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.co.jp.accountsquimyamzom.shop",nocase; classtype:attempted-recon; sid:200000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.tjccy.com",nocase; classtype:attempted-recon; sid:200000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.ywcimei.com",nocase; classtype:attempted-recon; sid:200000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaoznfuytweqfcaobi.xyz",nocase; classtype:attempted-recon; sid:200000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaxcarrentals.com.au",nocase; classtype:attempted-recon; sid:200000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amayzo.com",nocase; classtype:attempted-recon; sid:200000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazam.fkjnh.cn",nocase; classtype:attempted-recon; sid:200000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazam.ptwswaei.cn",nocase; classtype:attempted-recon; sid:200000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazcn.co-jp.service-help.la",nocase; classtype:attempted-recon; sid:200000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazcon.co.jp.gecmvu.cn",nocase; classtype:attempted-recon; sid:200000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazeprimev.com",nocase; classtype:attempted-recon; sid:200000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazm.psfsh.cn",nocase; classtype:attempted-recon; sid:200000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazmo.jbqqt.cn",nocase; classtype:attempted-recon; sid:200000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazna.fesitetyres.cn",nocase; classtype:attempted-recon; sid:200000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznll.cco.jjp.realestate-sg.net",nocase; classtype:attempted-recon; sid:200000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.dzjgrwn.cn",nocase; classtype:attempted-recon; sid:200000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.hjhroqt.cn",nocase; classtype:attempted-recon; sid:200000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.jp.vnzo.cn",nocase; classtype:attempted-recon; sid:200000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.codhta.cn",nocase; classtype:attempted-recon; sid:200000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.feaqji.cn",nocase; classtype:attempted-recon; sid:200000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.gkoswaeim.cn",nocase; classtype:attempted-recon; sid:200000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.hlptxbfjnr.cn",nocase; classtype:attempted-recon; sid:200000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.imbolg.cn",nocase; classtype:attempted-recon; sid:200000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.kfbefw.cn",nocase; classtype:attempted-recon; sid:200000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.ldiwzjt.cn",nocase; classtype:attempted-recon; sid:200000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.nadvwq.cn",nocase; classtype:attempted-recon; sid:200000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.pqocztt.cn",nocase; classtype:attempted-recon; sid:200000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.quxbf.cn",nocase; classtype:attempted-recon; sid:200000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.zhenais.cn",nocase; classtype:attempted-recon; sid:200000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazomn.jfugvkev.cn",nocase; classtype:attempted-recon; sid:200000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazomn.opbzqqt.cn",nocase; classtype:attempted-recon; sid:200000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ko1j.top",nocase; classtype:attempted-recon; sid:200000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.wzq997.top",nocase; classtype:attempted-recon; sid:200000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8332.vip",nocase; classtype:attempted-recon; sid:200000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8351.vip",nocase; classtype:attempted-recon; sid:200000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8353.vip",nocase; classtype:attempted-recon; sid:200000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8356.vip",nocase; classtype:attempted-recon; sid:200000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-d.cyou",nocase; classtype:attempted-recon; sid:200000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-f.buzz",nocase; classtype:attempted-recon; sid:200000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-gcatech.com",nocase; classtype:attempted-recon; sid:200000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-interruption.com",nocase; classtype:attempted-recon; sid:200000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.27deantterwow.club",nocase; classtype:attempted-recon; sid:200000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.aypjv.cn",nocase; classtype:attempted-recon; sid:200000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.cfbgup.cn",nocase; classtype:attempted-recon; sid:200000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.chbnkz.cn",nocase; classtype:attempted-recon; sid:200000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.nezabbm.cn",nocase; classtype:attempted-recon; sid:200000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.stjpsy.cn",nocase; classtype:attempted-recon; sid:200000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoncard-info.pyasieurs.shop",nocase; classtype:attempted-recon; sid:200000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoncojp.29deantterwow.club",nocase; classtype:attempted-recon; sid:200000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoneo.labelman.ltd",nocase; classtype:attempted-recon; sid:200000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoneo.oxlymva.cn",nocase; classtype:attempted-recon; sid:200000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoneo.tmlubocv.cn",nocase; classtype:attempted-recon; sid:200000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoneo.wrmdrxi.cn",nocase; classtype:attempted-recon; sid:200000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonjapanab.cn",nocase; classtype:attempted-recon; sid:200000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonjapanlai.cf",nocase; classtype:attempted-recon; sid:200000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonjpyingyu.ml",nocase; classtype:attempted-recon; sid:200000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonlogistics-ap-northeast-1.amazonlogistics.jp",nocase; classtype:attempted-recon; sid:200000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonoe.amvzdsjs.cn",nocase; classtype:attempted-recon; sid:200000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonveuifsdvgbue.xyz",nocase; classtype:attempted-recon; sid:200000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoon.co.jjp.damarsozler.net",nocase; classtype:attempted-recon; sid:200000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambienteprotegido.foregon.com",nocase; classtype:attempted-recon; sid:200000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amc-training.com",nocase; classtype:attempted-recon; sid:200000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amcgardiennage.com",nocase; classtype:attempted-recon; sid:200000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amco.jp.bxpgvhy.cn",nocase; classtype:attempted-recon; sid:200000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozon.ghuvys.cn",nocase; classtype:attempted-recon; sid:200000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americaneixprizss.com",nocase; classtype:attempted-recon; sid:200000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americanexprizss.com",nocase; classtype:attempted-recon; sid:200000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americcovcare.com",nocase; classtype:attempted-recon; sid:200000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amerinie47.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.afztex.cn",nocase; classtype:attempted-recon; sid:200000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.bfehna.cn",nocase; classtype:attempted-recon; sid:200000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.cnksrz.top",nocase; classtype:attempted-recon; sid:200000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.cvjzcp.cn",nocase; classtype:attempted-recon; sid:200000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.dkryrd.cn",nocase; classtype:attempted-recon; sid:200000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.dnhwrq.top",nocase; classtype:attempted-recon; sid:200000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.dnxnrz.top",nocase; classtype:attempted-recon; sid:200000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.efktrh.cn",nocase; classtype:attempted-recon; sid:200000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.exjzqr.cn",nocase; classtype:attempted-recon; sid:200000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fbkjxm.cn",nocase; classtype:attempted-recon; sid:200000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.flxlwh.cn",nocase; classtype:attempted-recon; sid:200000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fmuwhn.cn",nocase; classtype:attempted-recon; sid:200000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fnfsrp.top",nocase; classtype:attempted-recon; sid:200000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fnpzrb.top",nocase; classtype:attempted-recon; sid:200000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.ftunqv.cn",nocase; classtype:attempted-recon; sid:200000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fwte4t4.cn",nocase; classtype:attempted-recon; sid:200000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fysltm.cn",nocase; classtype:attempted-recon; sid:200000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.fzqsru.cn",nocase; classtype:attempted-recon; sid:200000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gasrcf.cn",nocase; classtype:attempted-recon; sid:200000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gjivhm.cn",nocase; classtype:attempted-recon; sid:200000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gnqxrf.top",nocase; classtype:attempted-recon; sid:200000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gplvqu.cn",nocase; classtype:attempted-recon; sid:200000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gqsksu.cn",nocase; classtype:attempted-recon; sid:200000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.gvcycm.cn",nocase; classtype:attempted-recon; sid:200000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.h5xn6g.cn",nocase; classtype:attempted-recon; sid:200000640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.hccshw.cn",nocase; classtype:attempted-recon; sid:200000641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.hcdfhy.cn",nocase; classtype:attempted-recon; sid:200000642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.iwiknb.cn",nocase; classtype:attempted-recon; sid:200000643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.jirpeb.cn",nocase; classtype:attempted-recon; sid:200000644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.knhrrs.top",nocase; classtype:attempted-recon; sid:200000645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.kvgsas.cn",nocase; classtype:attempted-recon; sid:200000646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.kwfzje.cn",nocase; classtype:attempted-recon; sid:200000647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.lknzkt.cn",nocase; classtype:attempted-recon; sid:200000648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.lngtrd.top",nocase; classtype:attempted-recon; sid:200000649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.lngxrg.top",nocase; classtype:attempted-recon; sid:200000650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.mdwcxp.cn",nocase; classtype:attempted-recon; sid:200000651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.mnxxrl.top",nocase; classtype:attempted-recon; sid:200000652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.n7sl78.cn",nocase; classtype:attempted-recon; sid:200000653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.ndpjam.cn",nocase; classtype:attempted-recon; sid:200000654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.nmqubs.cn",nocase; classtype:attempted-recon; sid:200000655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.nnzxry.top",nocase; classtype:attempted-recon; sid:200000656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.nqtqwa.cn",nocase; classtype:attempted-recon; sid:200000657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.odqczp.cn",nocase; classtype:attempted-recon; sid:200000658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.oiodap.cn",nocase; classtype:attempted-recon; sid:200000659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.owtiis.cn",nocase; classtype:attempted-recon; sid:200000660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.plubnf.cn",nocase; classtype:attempted-recon; sid:200000661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.pnpsrt.top",nocase; classtype:attempted-recon; sid:200000662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.prqjer.cn",nocase; classtype:attempted-recon; sid:200000663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.qfurjx.cn",nocase; classtype:attempted-recon; sid:200000664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.quccpr.cn",nocase; classtype:attempted-recon; sid:200000665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.rpcmaj.cn",nocase; classtype:attempted-recon; sid:200000666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.snblrb.top",nocase; classtype:attempted-recon; sid:200000667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.tltspx.cn",nocase; classtype:attempted-recon; sid:200000668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.tnhgrj.top",nocase; classtype:attempted-recon; sid:200000669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.tnlhrk.top",nocase; classtype:attempted-recon; sid:200000670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.tosrhl.cn",nocase; classtype:attempted-recon; sid:200000671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.tuoxpy.cn",nocase; classtype:attempted-recon; sid:200000672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.uvjvkv.cn",nocase; classtype:attempted-recon; sid:200000673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.vbwrai.cn",nocase; classtype:attempted-recon; sid:200000674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.vgeuap.cn",nocase; classtype:attempted-recon; sid:200000675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.wnkkrm.top",nocase; classtype:attempted-recon; sid:200000676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.wsewiq.cn",nocase; classtype:attempted-recon; sid:200000677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.xtpudi.cn",nocase; classtype:attempted-recon; sid:200000678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.ynooae.cn",nocase; classtype:attempted-recon; sid:200000679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezom.zcjdrx.cn",nocase; classtype:attempted-recon; sid:200000680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amguevara.com",nocase; classtype:attempted-recon; sid:200000681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amidabuli.com",nocase; classtype:attempted-recon; sid:200000682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amitydiamonds.com",nocase; classtype:attempted-recon; sid:200000683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amnsvc.9ncki20.cn",nocase; classtype:attempted-recon; sid:200000684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amoczn.co.ip.hsakjxzz.cn",nocase; classtype:attempted-recon; sid:200000685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amonaz.co.jp.wearepletouhatyorremirputdnupandisoperational05.cf",nocase; classtype:attempted-recon; sid:200000686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozan.co.jp.amzoccountchop.shop",nocase; classtype:attempted-recon; sid:200000687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozanm-rrbrb.cc",nocase; classtype:attempted-recon; sid:200000688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozanm-rrere.cc",nocase; classtype:attempted-recon; sid:200000689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.akfcw.com.cn",nocase; classtype:attempted-recon; sid:200000690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.bdrsbj.com.cn",nocase; classtype:attempted-recon; sid:200000691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.bjhjbw.com.cn",nocase; classtype:attempted-recon; sid:200000692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.bjzqjasz.com.cn",nocase; classtype:attempted-recon; sid:200000693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.bwlxb.com.cn",nocase; classtype:attempted-recon; sid:200000694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.hzfx888.com.cn",nocase; classtype:attempted-recon; sid:200000695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.hzgjmw.com.cn",nocase; classtype:attempted-recon; sid:200000696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.lixidc.com.cn",nocase; classtype:attempted-recon; sid:200000697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.oukei.com.cn",nocase; classtype:attempted-recon; sid:200000698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.stfuse.com.cn",nocase; classtype:attempted-recon; sid:200000699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozon.co.ip.xiaozaoaike.com.cn",nocase; classtype:attempted-recon; sid:200000700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amprojanitorial.com",nocase; classtype:attempted-recon; sid:200000701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams-eg.com",nocase; classtype:attempted-recon; sid:200000702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amsinternational.fr",nocase; classtype:attempted-recon; sid:200000703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amtodnshi63.aonmthis.top",nocase; classtype:attempted-recon; sid:200000704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amwstore.com",nocase; classtype:attempted-recon; sid:200000705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amxericanexpess.com",nocase; classtype:attempted-recon; sid:200000706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amybwt.covidharsh.com",nocase; classtype:attempted-recon; sid:200000707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzaomaz.co.jp.wearepletouhatyorremirputdnupandisoperational.ml",nocase; classtype:attempted-recon; sid:200000708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzona.co.jp.amozno.top",nocase; classtype:attempted-recon; sid:200000709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"an.jp.zdimbb.cn",nocase; classtype:attempted-recon; sid:200000710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"an.jp.zgj027.cn",nocase; classtype:attempted-recon; sid:200000711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anabolic-online.com",nocase; classtype:attempted-recon; sid:200000712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anamoreno27041.vzpla.net",nocase; classtype:attempted-recon; sid:200000713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anandsr-dev.github.io",nocase; classtype:attempted-recon; sid:200000714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anarchitecturestudio.com",nocase; classtype:attempted-recon; sid:200000715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anatomie.univ-catholille.fr",nocase; classtype:attempted-recon; sid:200000716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anazno.co.ip.6.cn",nocase; classtype:attempted-recon; sid:200000717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anazno.co.ip.ksspwj.shop",nocase; classtype:attempted-recon; sid:200000718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anbn.ru",nocase; classtype:attempted-recon; sid:200000719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anbusign.com",nocase; classtype:attempted-recon; sid:200000720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anchorofhopeglobalmissions.org",nocase; classtype:attempted-recon; sid:200000721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ancient-lab-15b5.rhn21600.workers.dev",nocase; classtype:attempted-recon; sid:200000722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.ip.af2ln.cn",nocase; classtype:attempted-recon; sid:200000723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.ip.ajfreaa.cn",nocase; classtype:attempted-recon; sid:200000724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.ip.cclc2d.cn",nocase; classtype:attempted-recon; sid:200000725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.ip.cclm2k.cn",nocase; classtype:attempted-recon; sid:200000726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.jp.chhh2n.cn",nocase; classtype:attempted-recon; sid:200000727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anco.jp.jonbxgt.cn",nocase; classtype:attempted-recon; sid:200000728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andersonstrategic.com.au",nocase; classtype:attempted-recon; sid:200000729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andhraelec.com",nocase; classtype:attempted-recon; sid:200000730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andre-leone.format.com",nocase; classtype:attempted-recon; sid:200000731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-23.web.id",nocase; classtype:attempted-recon; sid:200000732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-27.web.id",nocase; classtype:attempted-recon; sid:200000733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-29.web.id",nocase; classtype:attempted-recon; sid:200000734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-779.my.id",nocase; classtype:attempted-recon; sid:200000735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aniak82genesh.com",nocase; classtype:attempted-recon; sid:200000736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anj-azakp.run.goorm.io",nocase; classtype:attempted-recon; sid:200000737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anjalijha167.github.io",nocase; classtype:attempted-recon; sid:200000738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anmazon.xqtst.cn",nocase; classtype:attempted-recon; sid:200000739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anme.hyperphp.com",nocase; classtype:attempted-recon; sid:200000740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annamalaiyarconstruction.com",nocase; classtype:attempted-recon; sid:200000741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annazon.swkbowb.cn",nocase; classtype:attempted-recon; sid:200000742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anomalous-new-inspect.5g04fw.cn",nocase; classtype:attempted-recon; sid:200000743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anonzon.vzdhlptxbf.cn",nocase; classtype:attempted-recon; sid:200000744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antalyaozelguvenlik.com",nocase; classtype:attempted-recon; sid:200000745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antaresns.com",nocase; classtype:attempted-recon; sid:200000746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antiguatabernaqueirolo.com",nocase; classtype:attempted-recon; sid:200000747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anvpwy.covidharsh.com",nocase; classtype:attempted-recon; sid:200000748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ao.jp.co.bjcwx.cn",nocase; classtype:attempted-recon; sid:200000749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aoijlli-illaolk.weebly.com",nocase; classtype:attempted-recon; sid:200000750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aoler0000ooo00oereooo00oo.weebly.com",nocase; classtype:attempted-recon; sid:200000751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aolrei.weebly.com",nocase; classtype:attempted-recon; sid:200000752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apbxkc.covidharsh.com",nocase; classtype:attempted-recon; sid:200000753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apeswap-ress.tech",nocase; classtype:attempted-recon; sid:200000754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apeswapa.finance",nocase; classtype:attempted-recon; sid:200000755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apexdeliverymm.com",nocase; classtype:attempted-recon; sid:200000756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apexequipment.in",nocase; classtype:attempted-recon; sid:200000757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.cargomanager.io",nocase; classtype:attempted-recon; sid:200000758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apikesbandung.ac.id",nocase; classtype:attempted-recon; sid:200000759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkandroid.ru",nocase; classtype:attempted-recon; sid:200000760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkily.com",nocase; classtype:attempted-recon; sid:200000761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkun.com",nocase; classtype:attempted-recon; sid:200000762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apoyoeconomico-beneficiario-bcpaveriguaqui.bonosrapidos.com",nocase; classtype:attempted-recon; sid:200000763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apoyovirtualscience.com",nocase; classtype:attempted-recon; sid:200000764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-dec-access.com",nocase; classtype:attempted-recon; sid:200000765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-pancakeswap.com",nocase; classtype:attempted-recon; sid:200000766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-pancakeswap.ml",nocase; classtype:attempted-recon; sid:200000767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.duel.network",nocase; classtype:attempted-recon; sid:200000768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.fiiber.ca",nocase; classtype:attempted-recon; sid:200000769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.fxhalifax.com",nocase; classtype:attempted-recon; sid:200000770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.moneylinecreditcorporation.com",nocase; classtype:attempted-recon; sid:200000771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.mtw88.cn",nocase; classtype:attempted-recon; sid:200000772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.n26.com.sicurezzadeldati.com",nocase; classtype:attempted-recon; sid:200000773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.n26.com.verificatoinformazioni.com",nocase; classtype:attempted-recon; sid:200000774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pakikieshwap.com",nocase; classtype:attempted-recon; sid:200000775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankeikswiap.com",nocase; classtype:attempted-recon; sid:200000776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankeikswiaps.com",nocase; classtype:attempted-recon; sid:200000777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankieiswapis.com",nocase; classtype:attempted-recon; sid:200000778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.sugarsync.com",nocase; classtype:attempted-recon; sid:200000779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.surveymethods.com",nocase; classtype:attempted-recon; sid:200000780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.uniswapfund.org",nocase; classtype:attempted-recon; sid:200000781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app28.greenmail.co.in",nocase; classtype:attempted-recon; sid:200000782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appatualizecef.com",nocase; classtype:attempted-recon; sid:200000783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appcefseguros.me",nocase; classtype:attempted-recon; sid:200000784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-form-fb-copyright1251.web.app",nocase; classtype:attempted-recon; sid:200000785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apple.com.services-and-support.com",nocase; classtype:attempted-recon; sid:200000786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"applebankny.com",nocase; classtype:attempted-recon; sid:200000787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appleisred.in",nocase; classtype:attempted-recon; sid:200000788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"applekoreas.net",nocase; classtype:attempted-recon; sid:200000789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"applekra.com",nocase; classtype:attempted-recon; sid:200000790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appleverificationalert.com",nocase; classtype:attempted-recon; sid:200000791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"application-submit928-lrs.com",nocase; classtype:attempted-recon; sid:200000792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"applocal21.wpengine.com",nocase; classtype:attempted-recon; sid:200000793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apprescounsfe.rf.gd",nocase; classtype:attempted-recon; sid:200000794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appssn26.com",nocase; classtype:attempted-recon; sid:200000795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aprescounpage.rf.gd",nocase; classtype:attempted-recon; sid:200000796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aprisapage.rf.gd",nocase; classtype:attempted-recon; sid:200000797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aqadeer1965genesh.com",nocase; classtype:attempted-recon; sid:200000798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aqtv.tv",nocase; classtype:attempted-recon; sid:200000799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aquapura-eg.com",nocase; classtype:attempted-recon; sid:200000800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aquarium-cleaning.ru",nocase; classtype:attempted-recon; sid:200000801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arafathrumman.github.io",nocase; classtype:attempted-recon; sid:200000802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"araujoalan383.github.io",nocase; classtype:attempted-recon; sid:200000803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archivio-supporto.sitoper.it",nocase; classtype:attempted-recon; sid:200000804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archstoneconsults.com",nocase; classtype:attempted-recon; sid:200000805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arcomindia.com",nocase; classtype:attempted-recon; sid:200000806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areaprivata-clientimps-db.com",nocase; classtype:attempted-recon; sid:200000807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areaprivata-clientimps.com",nocase; classtype:attempted-recon; sid:200000808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areariservata-mpsclienti.com",nocase; classtype:attempted-recon; sid:200000809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.8nuyv54.cn",nocase; classtype:attempted-recon; sid:200000810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.bidvqz.cn",nocase; classtype:attempted-recon; sid:200000811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.bzzotg.cn",nocase; classtype:attempted-recon; sid:200000812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.dqbxpt.cn",nocase; classtype:attempted-recon; sid:200000813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.dsxyqe.cn",nocase; classtype:attempted-recon; sid:200000814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.fliy.cn",nocase; classtype:attempted-recon; sid:200000815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.gswzls.cn",nocase; classtype:attempted-recon; sid:200000816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.gtpzcve.cn",nocase; classtype:attempted-recon; sid:200000817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.gtva.cn",nocase; classtype:attempted-recon; sid:200000818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.hxykecd.cn",nocase; classtype:attempted-recon; sid:200000819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.ihidgb.cn",nocase; classtype:attempted-recon; sid:200000820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.nltpztp.cn",nocase; classtype:attempted-recon; sid:200000821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.nrks91.cn",nocase; classtype:attempted-recon; sid:200000822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.vbscdyejw.cn",nocase; classtype:attempted-recon; sid:200000823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.vcxllpotgf.cn",nocase; classtype:attempted-recon; sid:200000824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.wxhela.cn",nocase; classtype:attempted-recon; sid:200000825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.xqyons.cn",nocase; classtype:attempted-recon; sid:200000826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.ylawws.cn",nocase; classtype:attempted-recon; sid:200000827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"argenahomebanqbe.com",nocase; classtype:attempted-recon; sid:200000828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"argus-garage-doors-repair.com",nocase; classtype:attempted-recon; sid:200000829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ariabibixabi.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arianareflects.com",nocase; classtype:attempted-recon; sid:200000831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arislm.com",nocase; classtype:attempted-recon; sid:200000832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armatheatre.org",nocase; classtype:attempted-recon; sid:200000833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armazenamento.v6.army",nocase; classtype:attempted-recon; sid:200000834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armyeitaas.sharepoint-mil.us",nocase; classtype:attempted-recon; sid:200000835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnaozn.hsqhsjz.com",nocase; classtype:attempted-recon; sid:200000836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnaznoz.co.ip.x0az0er4zd5ivdsfsa0sczx.polopolo.cn",nocase; classtype:attempted-recon; sid:200000837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnazon.ip.namoui.shop",nocase; classtype:attempted-recon; sid:200000838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aromatic.webenliven.in",nocase; classtype:attempted-recon; sid:200000839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arris.surveysparrow.com",nocase; classtype:attempted-recon; sid:200000840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrizonaa.com",nocase; classtype:attempted-recon; sid:200000841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrowcase.com",nocase; classtype:attempted-recon; sid:200000842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artekcamp.tumblr.com",nocase; classtype:attempted-recon; sid:200000843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemisbetguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200000844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemissbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arthamahotels.com",nocase; classtype:attempted-recon; sid:200000846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"articles.investing-fund.com",nocase; classtype:attempted-recon; sid:200000847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificial-connect.de",nocase; classtype:attempted-recon; sid:200000848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.de",nocase; classtype:attempted-recon; sid:200000849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artmar-zamosc.pl",nocase; classtype:attempted-recon; sid:200000850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artogesres.byethost7.com",nocase; classtype:attempted-recon; sid:200000851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aruba-fattura-area.me",nocase; classtype:attempted-recon; sid:200000852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aruba-pagamento-sys.com",nocase; classtype:attempted-recon; sid:200000853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascensoresyaireacondicionado.com",nocase; classtype:attempted-recon; sid:200000854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascent-scaffolding.co.uk",nocase; classtype:attempted-recon; sid:200000855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asddfgfghfghfghfg.ddns.net",nocase; classtype:attempted-recon; sid:200000856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asdkjalasjdkhfad.byethost33.com",nocase; classtype:attempted-recon; sid:200000857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asesoriaforonda.com",nocase; classtype:attempted-recon; sid:200000858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asf.mfvhnrt17z.workers.dev",nocase; classtype:attempted-recon; sid:200000859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asgard-ampqy.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ash14213.mfs.gg",nocase; classtype:attempted-recon; sid:200000861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ashleygracebridal.com",nocase; classtype:attempted-recon; sid:200000862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiadiscoversolutions.azureedge.net",nocase; classtype:attempted-recon; sid:200000863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiastarchsolutions.com",nocase; classtype:attempted-recon; sid:200000864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asistentevirtual.byethost22.com",nocase; classtype:attempted-recon; sid:200000865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asjkhdaskjdhas.com",nocase; classtype:attempted-recon; sid:200000866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"askarmotorluaraclar.com",nocase; classtype:attempted-recon; sid:200000867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asmfol.covidharsh.com",nocase; classtype:attempted-recon; sid:200000868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asorange.fr",nocase; classtype:attempted-recon; sid:200000869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asp403r.paperless.com.pe",nocase; classtype:attempted-recon; sid:200000870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assaolmember.weebly.com",nocase; classtype:attempted-recon; sid:200000871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assghyhjjfd.square.site",nocase; classtype:attempted-recon; sid:200000872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assistance-paiement-securise-leboncoin.com",nocase; classtype:attempted-recon; sid:200000873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assistenza-utenti-card.com",nocase; classtype:attempted-recon; sid:200000874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assistenzaintesaonline.com",nocase; classtype:attempted-recon; sid:200000875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"astorehub.com",nocase; classtype:attempted-recon; sid:200000876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"at-t-support-service1.sitey.me",nocase; classtype:attempted-recon; sid:200000877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"at-t-yahoo.sitey.me",nocase; classtype:attempted-recon; sid:200000878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendentedaycoval.no.comunidades.net",nocase; classtype:attempted-recon; sid:200000879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimento-digital.ga",nocase; classtype:attempted-recon; sid:200000880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentocaixa.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200000881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentocompleto24horas.cf",nocase; classtype:attempted-recon; sid:200000882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentocompleto24horas.ml",nocase; classtype:attempted-recon; sid:200000883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentoltau24hrs.com",nocase; classtype:attempted-recon; sid:200000884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atento-fdi.plusoftomni.com.br",nocase; classtype:attempted-recon; sid:200000885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ativacao-online73681.com",nocase; classtype:attempted-recon; sid:200000886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atlasbet725.com",nocase; classtype:attempted-recon; sid:200000887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attached-file.gq",nocase; classtype:attempted-recon; sid:200000888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attatattatttattatt.weebly.com",nocase; classtype:attempted-recon; sid:200000889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attbhubhccbc.weebly.com",nocase; classtype:attempted-recon; sid:200000890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attcom-prod06a.adobecqms.net",nocase; classtype:attempted-recon; sid:200000891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attdomainkastservicess.weebly.com",nocase; classtype:attempted-recon; sid:200000892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailboxsync.weebly.com",nocase; classtype:attempted-recon; sid:200000893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailcommunicationservicedomain.weebly.com",nocase; classtype:attempted-recon; sid:200000894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailserviceclosre.weebly.com",nocase; classtype:attempted-recon; sid:200000895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmainpod.weebly.com",nocase; classtype:attempted-recon; sid:200000896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnet.hyperphp.com",nocase; classtype:attempted-recon; sid:200000897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnet4.aidaform.com",nocase; classtype:attempted-recon; sid:200000898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnetmailss.weebly.com",nocase; classtype:attempted-recon; sid:200000899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attonlneservice.weebly.com",nocase; classtype:attempted-recon; sid:200000900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attrelogin.weebly.com",nocase; classtype:attempted-recon; sid:200000901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attservicememberighiy.weebly.com",nocase; classtype:attempted-recon; sid:200000902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attservicesgs.heteml.net",nocase; classtype:attempted-recon; sid:200000903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attsupgft1.weebly.com",nocase; classtype:attempted-recon; sid:200000904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizacao-online547864.com",nocase; classtype:attempted-recon; sid:200000905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizacaocaixa3030.pt",nocase; classtype:attempted-recon; sid:200000906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizaonline2533.com",nocase; classtype:attempted-recon; sid:200000907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizeapkcaix.com",nocase; classtype:attempted-recon; sid:200000908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"au.rei-npo.org",nocase; classtype:attempted-recon; sid:200000909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aubootlegger.com",nocase; classtype:attempted-recon; sid:200000910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.auone.jp.gemiterf.gq",nocase; classtype:attempted-recon; sid:200000911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aushotel.es",nocase; classtype:attempted-recon; sid:200000912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-redirect08c.com",nocase; classtype:attempted-recon; sid:200000913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-task1-m.web.app",nocase; classtype:attempted-recon; sid:200000914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-webmailakeonetcom.yolasite.com",nocase; classtype:attempted-recon; sid:200000915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login03.3-a.net",nocase; classtype:attempted-recon; sid:200000916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login04.3-a.net",nocase; classtype:attempted-recon; sid:200000917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login05.3-a.net",nocase; classtype:attempted-recon; sid:200000918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login06.3-a.net",nocase; classtype:attempted-recon; sid:200000919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login07.3-a.net",nocase; classtype:attempted-recon; sid:200000920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login09.3-a.net",nocase; classtype:attempted-recon; sid:200000921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login12.3-a.net",nocase; classtype:attempted-recon; sid:200000922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login13.3-a.net",nocase; classtype:attempted-recon; sid:200000923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login14.3-a.net",nocase; classtype:attempted-recon; sid:200000924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login16.3-a.net",nocase; classtype:attempted-recon; sid:200000925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login17.3-a.net",nocase; classtype:attempted-recon; sid:200000926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login18.3-a.net",nocase; classtype:attempted-recon; sid:200000927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login19.3-a.net",nocase; classtype:attempted-recon; sid:200000928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth05secureverify-login20.3-a.net",nocase; classtype:attempted-recon; sid:200000929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth23723-cdn2384-mainage3284.com",nocase; classtype:attempted-recon; sid:200000930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authenticationteam.creatorlink.net",nocase; classtype:attempted-recon; sid:200000931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authmtb3.duckdns.org",nocase; classtype:attempted-recon; sid:200000932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authorisemytransfer.com",nocase; classtype:attempted-recon; sid:200000933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authuxeehmutconjxmailssocl.web.app",nocase; classtype:attempted-recon; sid:200000934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoatendimento.caixaresidencial.com.br",nocase; classtype:attempted-recon; sid:200000935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodetailingdelivered.info",nocase; classtype:attempted-recon; sid:200000936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.gre.ac.uk",nocase; classtype:attempted-recon; sid:200000937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.ryder-dutton.co.uk",nocase; classtype:attempted-recon; sid:200000938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.sandrsecurity.com",nocase; classtype:attempted-recon; sid:200000939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoexprs.com",nocase; classtype:attempted-recon; sid:200000940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autolikesfree.net",nocase; classtype:attempted-recon; sid:200000941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autorizador5.com.br",nocase; classtype:attempted-recon; sid:200000942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoscurt24.de",nocase; classtype:attempted-recon; sid:200000943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autosrobadoschile.com",nocase; classtype:attempted-recon; sid:200000944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autumn-sun-4a21.paqesads-scure.workers.dev",nocase; classtype:attempted-recon; sid:200000945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avadvertising.in",nocase; classtype:attempted-recon; sid:200000946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avckage.bookofblue.eu",nocase; classtype:attempted-recon; sid:200000947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aviabcp.com",nocase; classtype:attempted-recon; sid:200000948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avisoscotia.byethost7.com",nocase; classtype:attempted-recon; sid:200000949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avisotransacao.com",nocase; classtype:attempted-recon; sid:200000950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avispichinchwe.byethost18.com",nocase; classtype:attempted-recon; sid:200000951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awgxwv.covidharsh.com",nocase; classtype:attempted-recon; sid:200000952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awmchannel.org",nocase; classtype:attempted-recon; sid:200000953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awptdh.webwave.dev",nocase; classtype:attempted-recon; sid:200000954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-e.icu",nocase; classtype:attempted-recon; sid:200000955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-fb.shop",nocase; classtype:attempted-recon; sid:200000956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-ppnet.net",nocase; classtype:attempted-recon; sid:200000957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-y.shop",nocase; classtype:attempted-recon; sid:200000958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axe.su",nocase; classtype:attempted-recon; sid:200000959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axeinfinity.net",nocase; classtype:attempted-recon; sid:200000960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axhvjynd.paperform.co",nocase; classtype:attempted-recon; sid:200000961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axie-lnfinity.com",nocase; classtype:attempted-recon; sid:200000962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinity.city",nocase; classtype:attempted-recon; sid:200000963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinitygift.com",nocase; classtype:attempted-recon; sid:200000964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axienomics.finance",nocase; classtype:attempted-recon; sid:200000965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axlelnfinity.com",nocase; classtype:attempted-recon; sid:200000966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axxcticionesco30.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayasteakhouse.com",nocase; classtype:attempted-recon; sid:200000968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayazmasud.buet.ac.bd",nocase; classtype:attempted-recon; sid:200000969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayooberita.com",nocase; classtype:attempted-recon; sid:200000970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayushayurveda.in",nocase; classtype:attempted-recon; sid:200000971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azaharpanama.com",nocase; classtype:attempted-recon; sid:200000972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azb3s.cf",nocase; classtype:attempted-recon; sid:200000973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azcouncheks.rf.gd",nocase; classtype:attempted-recon; sid:200000974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azmno.ip.jjp.bjax.net",nocase; classtype:attempted-recon; sid:200000975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azmno.ip.jp.bubujingqingdsjqj.net",nocase; classtype:attempted-recon; sid:200000976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azmno.ip.jp.sistemacolet.net",nocase; classtype:attempted-recon; sid:200000977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azosimoveis.com",nocase; classtype:attempted-recon; sid:200000978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com",nocase; classtype:attempted-recon; sid:200000979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b1uipxjwz8d.typeform.com",nocase; classtype:attempted-recon; sid:200000980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b2bchdistribution.app.link",nocase; classtype:attempted-recon; sid:200000981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev",nocase; classtype:attempted-recon; sid:200000982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b96f7f93.sibforms.com",nocase; classtype:attempted-recon; sid:200000983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev",nocase; classtype:attempted-recon; sid:200000984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b9tbtrond.weebly.com",nocase; classtype:attempted-recon; sid:200000985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"backupemnuvem.com.br",nocase; classtype:attempted-recon; sid:200000986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"backyardkilimani.com",nocase; classtype:attempted-recon; sid:200000987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bag-macben.eu",nocase; classtype:attempted-recon; sid:200000988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bail-services.i.ng",nocase; classtype:attempted-recon; sid:200000989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakaenteprises.ml",nocase; classtype:attempted-recon; sid:200000990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakerrecklaw.com",nocase; classtype:attempted-recon; sid:200000991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakhai.vn",nocase; classtype:attempted-recon; sid:200000992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"balkanconsult.ro",nocase; classtype:attempted-recon; sid:200000993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"balloonexperienceholland.eu",nocase; classtype:attempted-recon; sid:200000994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banca-electronica1.odoo.com",nocase; classtype:attempted-recon; sid:200000995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banca-intesa-sanpaolo.101ii2.tk",nocase; classtype:attempted-recon; sid:200000996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancainternetbank.weddingretuals.com",nocase; classtype:attempted-recon; sid:200000997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancalnternet-lnterbank.pe-lh.com",nocase; classtype:attempted-recon; sid:200000998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancamovilinferbankpe.pecelular.online",nocase; classtype:attempted-recon; sid:200000999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancanetinterbanks.findmorebacklinks.com",nocase; classtype:attempted-recon; sid:200001000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichiflowwd.byethost31.com",nocase; classtype:attempted-recon; sid:200001001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichincha.hostkda.com",nocase; classtype:attempted-recon; sid:200001002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichionliw.byethost4.com",nocase; classtype:attempted-recon; sid:200001003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-interbank.pe-logn.com",nocase; classtype:attempted-recon; sid:200001004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-netinterbankpe09.com",nocase; classtype:attempted-recon; sid:200001005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-netinterbankpe11.com",nocase; classtype:attempted-recon; sid:200001006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-netinterbankpe12.com",nocase; classtype:attempted-recon; sid:200001007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interban.novadigio.com",nocase; classtype:attempted-recon; sid:200001008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interban.pe.magictourscancs.info",nocase; classtype:attempted-recon; sid:200001009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interbrnpe.com",nocase; classtype:attempted-recon; sid:200001010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interhanks.info",nocase; classtype:attempted-recon; sid:200001011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbank.grupodigital.bnxoperu.com",nocase; classtype:attempted-recon; sid:200001012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbankperu.com",nocase; classtype:attempted-recon; sid:200001013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbnk.pe-lnt.com",nocase; classtype:attempted-recon; sid:200001014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet1-interbank.com",nocase; classtype:attempted-recon; sid:200001015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternetinterbankpe.site",nocase; classtype:attempted-recon; sid:200001016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet-interbank.pe-gg.com",nocase; classtype:attempted-recon; sid:200001017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet-interbank.pe-pl.com",nocase; classtype:attempted-recon; sid:200001018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet.lnterbank.banceninternet.com",nocase; classtype:attempted-recon; sid:200001019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporweblnferbank.pedigitalapp1.vip",nocase; classtype:attempted-recon; sid:200001020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaprinternet-interbank.pe-ids.com",nocase; classtype:attempted-recon; sid:200001021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancevirtual.hostkda.com",nocase; classtype:attempted-recon; sid:200001022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banco-proamerica.2host.me",nocase; classtype:attempted-recon; sid:200001023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banco-santander.ddns.cam",nocase; classtype:attempted-recon; sid:200001024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancogalicia.byethost6.com",nocase; classtype:attempted-recon; sid:200001025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoiing.site44.com",nocase; classtype:attempted-recon; sid:200001026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoiinng.site44.com",nocase; classtype:attempted-recon; sid:200001027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancomercantil-org.haxsecurity.org",nocase; classtype:attempted-recon; sid:200001028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoonline.2host.me",nocase; classtype:attempted-recon; sid:200001029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopichinchae9.byethost9.com",nocase; classtype:attempted-recon; sid:200001030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromerica00.byethost4.com",nocase; classtype:attempted-recon; sid:200001031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericac0.byethost7.com",nocase; classtype:attempted-recon; sid:200001032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericaon.byethost33.com",nocase; classtype:attempted-recon; sid:200001033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericass.byethost7.com",nocase; classtype:attempted-recon; sid:200001034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancraporinternet.wmac.com.ar",nocase; classtype:attempted-recon; sid:200001035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancwebpichi.byethost8.com",nocase; classtype:attempted-recon; sid:200001036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bandbajabarat.pk",nocase; classtype:attempted-recon; sid:200001037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangjamus.co.vu",nocase; classtype:attempted-recon; sid:200001038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangjurmins.co.vu",nocase; classtype:attempted-recon; sid:200001039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangladesh-association.com",nocase; classtype:attempted-recon; sid:200001040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangpromex1.webcindario.com",nocase; classtype:attempted-recon; sid:200001041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangrove-ad.com",nocase; classtype:attempted-recon; sid:200001042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangte008.cn",nocase; classtype:attempted-recon; sid:200001043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banhywkaie.com",nocase; classtype:attempted-recon; sid:200001044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banistmo.byethost18.com",nocase; classtype:attempted-recon; sid:200001045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banistmo.com.frankopro.com",nocase; classtype:attempted-recon; sid:200001046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bank-of-america-secure00.dns05.com",nocase; classtype:attempted-recon; sid:200001047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bank.azur-finance.com",nocase; classtype:attempted-recon; sid:200001048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankapolska.com",nocase; classtype:attempted-recon; sid:200001049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankaribe01.byethost4.com",nocase; classtype:attempted-recon; sid:200001050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banki0wa.us",nocase; classtype:attempted-recon; sid:200001051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankiigalicia.ihostfull.com",nocase; classtype:attempted-recon; sid:200001052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banking.n26.com.verificaanagrafici.com",nocase; classtype:attempted-recon; sid:200001053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankingalicias.ihostfull.com",nocase; classtype:attempted-recon; sid:200001054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankngaliciaa.ihostfull.com",nocase; classtype:attempted-recon; sid:200001055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankofamericanas.com",nocase; classtype:attempted-recon; sid:200001056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankofgua.com",nocase; classtype:attempted-recon; sid:200001057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankofguaa.com",nocase; classtype:attempted-recon; sid:200001058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankpromer1ca.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bannerbank.control-inc.com",nocase; classtype:attempted-recon; sid:200001060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bannerchampnyc.com",nocase; classtype:attempted-recon; sid:200001061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpichinchaweba.byethost11.com",nocase; classtype:attempted-recon; sid:200001062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpichinchweban.byethost17.com",nocase; classtype:attempted-recon; sid:200001063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banprome.byethost7.com",nocase; classtype:attempted-recon; sid:200001064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpromeca12.byethost18.com",nocase; classtype:attempted-recon; sid:200001065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banreservasdigital.com",nocase; classtype:attempted-recon; sid:200001066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baradua.it",nocase; classtype:attempted-recon; sid:200001067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bargesurekhaslate.com",nocase; classtype:attempted-recon; sid:200001068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bas9casc3.qwe-dasd-asd.workers.dev",nocase; classtype:attempted-recon; sid:200001069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"basopkingsantge.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bay81studios.com",nocase; classtype:attempted-recon; sid:200001071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbcartoes.net",nocase; classtype:attempted-recon; sid:200001072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbk.mmufg.jjp.kbcustomhomes.net",nocase; classtype:attempted-recon; sid:200001073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbn.biswop.sbs",nocase; classtype:attempted-recon; sid:200001074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbncrr.webcindario.com",nocase; classtype:attempted-recon; sid:200001075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbsuporteacesso24horas.com",nocase; classtype:attempted-recon; sid:200001076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc.lbclbcpaiement.com",nocase; classtype:attempted-recon; sid:200001077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc.payreceivelbc.com",nocase; classtype:attempted-recon; sid:200001078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc1.paiementervice.com",nocase; classtype:attempted-recon; sid:200001079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc172c8e.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200001080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc3.lbcvirementlbc.com",nocase; classtype:attempted-recon; sid:200001081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcabankonline.com",nocase; classtype:attempted-recon; sid:200001082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bconclutmjy.ru",nocase; classtype:attempted-recon; sid:200001083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp-peru.com",nocase; classtype:attempted-recon; sid:200001084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp.futbolfinanciero.com.pe",nocase; classtype:attempted-recon; sid:200001085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp.world",nocase; classtype:attempted-recon; sid:200001086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpbetazonasegurabetaviabcp.com",nocase; classtype:attempted-recon; sid:200001087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpbetazonasegurabetaviabcp.live",nocase; classtype:attempted-recon; sid:200001088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpjobs.com",nocase; classtype:attempted-recon; sid:200001089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonaseguirabeta.com",nocase; classtype:attempted-recon; sid:200001090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonasegurabeta.viabcpv.com",nocase; classtype:attempted-recon; sid:200001091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonaseguras.viabcpv.com",nocase; classtype:attempted-recon; sid:200001092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonaseguro.viabpc.com",nocase; classtype:attempted-recon; sid:200001093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonsegurabeta-vlabcp-com.dtuofus.com",nocase; classtype:attempted-recon; sid:200001094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcvsalvador2021.hostfree.pw",nocase; classtype:attempted-recon; sid:200001095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdxxmg.top",nocase; classtype:attempted-recon; sid:200001096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"be-home.web.do",nocase; classtype:attempted-recon; sid:200001097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beaa493d.ns-u629df.shop",nocase; classtype:attempted-recon; sid:200001098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; classtype:attempted-recon; sid:200001099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bearmybrand.com",nocase; classtype:attempted-recon; sid:200001100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beast-blog.com",nocase; classtype:attempted-recon; sid:200001101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bebe1age.com",nocase; classtype:attempted-recon; sid:200001102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beetasusgrisi.blogspot.com",nocase; classtype:attempted-recon; sid:200001103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beetriyadh.com",nocase; classtype:attempted-recon; sid:200001104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"believes.ddnsking.com",nocase; classtype:attempted-recon; sid:200001105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beloanvi333.byethost7.com",nocase; classtype:attempted-recon; sid:200001106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"belvedereinfo.com",nocase; classtype:attempted-recon; sid:200001107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benamejicityofbaseball.com",nocase; classtype:attempted-recon; sid:200001108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.profile-locked.info",nocase; classtype:attempted-recon; sid:200001109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.resetid.mobi",nocase; classtype:attempted-recon; sid:200001110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.review-security.info",nocase; classtype:attempted-recon; sid:200001111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.verify-details.info",nocase; classtype:attempted-recon; sid:200001112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigonow.epizy.com",nocase; classtype:attempted-recon; sid:200001113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigoonline.com",nocase; classtype:attempted-recon; sid:200001114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendmytrend.com",nocase; classtype:attempted-recon; sid:200001115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benjasdsdhsdhsdjsdjs.my-board.org",nocase; classtype:attempted-recon; sid:200001116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benjim.com",nocase; classtype:attempted-recon; sid:200001117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benotea.com",nocase; classtype:attempted-recon; sid:200001118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benrefamdksi.blogspot.com",nocase; classtype:attempted-recon; sid:200001119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bequeenspoons.com",nocase; classtype:attempted-recon; sid:200001120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ber-vel.com",nocase; classtype:attempted-recon; sid:200001121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bergenfamiilycenter.org",nocase; classtype:attempted-recon; sid:200001122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berketurizm.com",nocase; classtype:attempted-recon; sid:200001123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berradoc-splashket-hostingerapp.net",nocase; classtype:attempted-recon; sid:200001124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berry-more.ru",nocase; classtype:attempted-recon; sid:200001125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bertilomalpartida.com",nocase; classtype:attempted-recon; sid:200001126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestaetigen.wpengine.com",nocase; classtype:attempted-recon; sid:200001127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestasusporgris.blogspot.com",nocase; classtype:attempted-recon; sid:200001128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbenefitsnow.life",nocase; classtype:attempted-recon; sid:200001129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbuyturizm.com.tr",nocase; classtype:attempted-recon; sid:200001130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestfive.main.jp",nocase; classtype:attempted-recon; sid:200001131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"besttest.synergize.co",nocase; classtype:attempted-recon; sid:200001132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bet.travel",nocase; classtype:attempted-recon; sid:200001133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beta.exodus-coupon.com",nocase; classtype:attempted-recon; sid:200001134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betaildragon-mon-site-web-cheetah-1.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200001135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus.club",nocase; classtype:attempted-recon; sid:200001136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus.me",nocase; classtype:attempted-recon; sid:200001137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus020.blogspot.com",nocase; classtype:attempted-recon; sid:200001138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus021.blogspot.com",nocase; classtype:attempted-recon; sid:200001139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus09.blogspot.com",nocase; classtype:attempted-recon; sid:200001140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus111.blogspot.com",nocase; classtype:attempted-recon; sid:200001141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus199.blogspot.com",nocase; classtype:attempted-recon; sid:200001142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2020.blogspot.com",nocase; classtype:attempted-recon; sid:200001143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2021.blogspot.com",nocase; classtype:attempted-recon; sid:200001144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus20211.blogspot.com",nocase; classtype:attempted-recon; sid:200001145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus20213.blogspot.com",nocase; classtype:attempted-recon; sid:200001146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus223.blogspot.com",nocase; classtype:attempted-recon; sid:200001147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus224.blogspot.com",nocase; classtype:attempted-recon; sid:200001148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus23.blogspot.com",nocase; classtype:attempted-recon; sid:200001149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus30.blogspot.com",nocase; classtype:attempted-recon; sid:200001150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus31.blogspot.com",nocase; classtype:attempted-recon; sid:200001151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus311.blogspot.com",nocase; classtype:attempted-recon; sid:200001152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus312.blogspot.com",nocase; classtype:attempted-recon; sid:200001153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus33.blogspot.com",nocase; classtype:attempted-recon; sid:200001154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus331.blogspot.com",nocase; classtype:attempted-recon; sid:200001155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus332.blogspot.com",nocase; classtype:attempted-recon; sid:200001156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus57.blogspot.com",nocase; classtype:attempted-recon; sid:200001157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus777.blogspot.com",nocase; classtype:attempted-recon; sid:200001158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuscom.blogspot.com",nocase; classtype:attempted-recon; sid:200001159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirdi.blogspot.com",nocase; classtype:attempted-recon; sid:200001160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiri.blogspot.com",nocase; classtype:attempted-recon; sid:200001161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiris11.blogspot.com",nocase; classtype:attempted-recon; sid:200001162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisadresi.blogspot.com",nocase; classtype:attempted-recon; sid:200001163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi.blogspot.com",nocase; classtype:attempted-recon; sid:200001165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi3.blogspot.com",nocase; classtype:attempted-recon; sid:200001166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi4.blogspot.com",nocase; classtype:attempted-recon; sid:200001167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200001168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek.blogspot.com",nocase; classtype:attempted-recon; sid:200001169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek1.blogspot.com",nocase; classtype:attempted-recon; sid:200001170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmekicin.blogspot.com",nocase; classtype:attempted-recon; sid:200001171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirsenesende.blogspot.com",nocase; classtype:attempted-recon; sid:200001172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusguncelgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200001173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslink1.blogspot.com",nocase; classtype:attempted-recon; sid:200001174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgir.blogspot.com",nocase; classtype:attempted-recon; sid:200001175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200001176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinal1.blogspot.com",nocase; classtype:attempted-recon; sid:200001177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinals.blogspot.com",nocase; classtype:attempted-recon; sid:200001178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasussgir.blogspot.com",nocase; classtype:attempted-recon; sid:200001179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasussgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200001180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusss.blogspot.com",nocase; classtype:attempted-recon; sid:200001181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkeygiris.blogspot.com",nocase; classtype:attempted-recon; sid:200001182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkiye.blogspot.com",nocase; classtype:attempted-recon; sid:200001183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkiyee.blogspot.com",nocase; classtype:attempted-recon; sid:200001184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusum1.blogspot.com",nocase; classtype:attempted-recon; sid:200001185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusuyelik.com",nocase; classtype:attempted-recon; sid:200001186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris1.blogspot.com",nocase; classtype:attempted-recon; sid:200001187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris2.blogspot.com",nocase; classtype:attempted-recon; sid:200001188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200001190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200001191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupum.blogspot.com",nocase; classtype:attempted-recon; sid:200001192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebet122.blogspot.com",nocase; classtype:attempted-recon; sid:200001193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200001194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergir4.blogspot.com",nocase; classtype:attempted-recon; sid:200001196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergiris3.blogspot.com",nocase; classtype:attempted-recon; sid:200001197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betqiuqiu.com",nocase; classtype:attempted-recon; sid:200001199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betterbodynet.acemlnc.com",nocase; classtype:attempted-recon; sid:200001200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bexwebmailupdate.web.app",nocase; classtype:attempted-recon; sid:200001201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beyondmenus.com",nocase; classtype:attempted-recon; sid:200001202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beyondoutdoor.com.au",nocase; classtype:attempted-recon; sid:200001203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bfnotion.ru",nocase; classtype:attempted-recon; sid:200001204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bg5t.gratishosting.cl",nocase; classtype:attempted-recon; sid:200001205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bg5t.rf.gd",nocase; classtype:attempted-recon; sid:200001206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgms.cit.net",nocase; classtype:attempted-recon; sid:200001207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgt1.byethost15.com",nocase; classtype:attempted-recon; sid:200001208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharathi1809.github.io",nocase; classtype:attempted-recon; sid:200001209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharatlaboratory.com",nocase; classtype:attempted-recon; sid:200001210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharattank.me",nocase; classtype:attempted-recon; sid:200001211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhavin0077.github.io",nocase; classtype:attempted-recon; sid:200001212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhbyby.cn",nocase; classtype:attempted-recon; sid:200001213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhfurniture.com.vn",nocase; classtype:attempted-recon; sid:200001214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirpetualang4.ml",nocase; classtype:attempted-recon; sid:200001215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biblio-emi.md",nocase; classtype:attempted-recon; sid:200001216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibwebshop.com",nocase; classtype:attempted-recon; sid:200001217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bicicentroslezama.com",nocase; classtype:attempted-recon; sid:200001218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bienlinea.com",nocase; classtype:attempted-recon; sid:200001219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"big-cash-baby.tcp4.me",nocase; classtype:attempted-recon; sid:200001220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigboxevents.com",nocase; classtype:attempted-recon; sid:200001221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigeye.com.pk",nocase; classtype:attempted-recon; sid:200001222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigskinscsgodota.net.ru",nocase; classtype:attempted-recon; sid:200001223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billing-errorhelp.com",nocase; classtype:attempted-recon; sid:200001224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billing-nflx.com",nocase; classtype:attempted-recon; sid:200001225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billingfailure-o2.com",nocase; classtype:attempted-recon; sid:200001226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bimoitua.byethost6.com",nocase; classtype:attempted-recon; sid:200001227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binarybenliveload.com",nocase; classtype:attempted-recon; sid:200001228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biquyetcongai.com",nocase; classtype:attempted-recon; sid:200001229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"birlacitywaterpark.com",nocase; classtype:attempted-recon; sid:200001230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biswop.sbs",nocase; classtype:attempted-recon; sid:200001231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitalchile.cl",nocase; classtype:attempted-recon; sid:200001232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitbaink.web.app",nocase; classtype:attempted-recon; sid:200001233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitemefoods.com.au",nocase; classtype:attempted-recon; sid:200001234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitferronort.blogspot.com",nocase; classtype:attempted-recon; sid:200001235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitflyer0.top",nocase; classtype:attempted-recon; sid:200001236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bithunnb.web.app",nocase; classtype:attempted-recon; sid:200001237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitmexinc.com",nocase; classtype:attempted-recon; sid:200001238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitstarz-kasino.com",nocase; classtype:attempted-recon; sid:200001239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitzclusive.com",nocase; classtype:attempted-recon; sid:200001240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bixlerdesignbuild.com",nocase; classtype:attempted-recon; sid:200001241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizlinktek.com",nocase; classtype:attempted-recon; sid:200001242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizzcityinfo.com",nocase; classtype:attempted-recon; sid:200001243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bjk.zagnadulte.workers.dev",nocase; classtype:attempted-recon; sid:200001244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bk.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200001245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bk.mmufg.jjp.therablty.com",nocase; classtype:attempted-recon; sid:200001246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bk.mufgg.ip.dslam.net.cn",nocase; classtype:attempted-recon; sid:200001247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bk.mufgg.ip.zchaoyun.net.cn",nocase; classtype:attempted-recon; sid:200001248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bkeeepvirllmlssyaaneew188.xxuz.com",nocase; classtype:attempted-recon; sid:200001249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-base.ru",nocase; classtype:attempted-recon; sid:200001250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-queen-d446.mylogindhlupdate.workers.dev",nocase; classtype:attempted-recon; sid:200001251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blanchevetements.com",nocase; classtype:attempted-recon; sid:200001252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bliiss.shop",nocase; classtype:attempted-recon; sid:200001253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blissful-fermi.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200001254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blocks.rn86.ru",nocase; classtype:attempted-recon; sid:200001255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.cotiabank.paypal-login.us",nocase; classtype:attempted-recon; sid:200001256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.drmostafafouadivf.com",nocase; classtype:attempted-recon; sid:200001257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.olx.pl.fastpayments.biz",nocase; classtype:attempted-recon; sid:200001258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.premiershop.com.br",nocase; classtype:attempted-recon; sid:200001259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.storrea.com",nocase; classtype:attempted-recon; sid:200001260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.tienghanthaybeo.com",nocase; classtype:attempted-recon; sid:200001261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.visionconsulting.ro",nocase; classtype:attempted-recon; sid:200001262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.weiwanjia.com",nocase; classtype:attempted-recon; sid:200001263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blogdoaltivo.com.br",nocase; classtype:attempted-recon; sid:200001264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bloomay.co",nocase; classtype:attempted-recon; sid:200001265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blowfish-ltd.co.uk",nocase; classtype:attempted-recon; sid:200001266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bloxformat.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluecall.org",nocase; classtype:attempted-recon; sid:200001268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluehorse.in",nocase; classtype:attempted-recon; sid:200001269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluntlogsdhls.b-cdn.net",nocase; classtype:attempted-recon; sid:200001270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnacion.byethost7.com",nocase; classtype:attempted-recon; sid:200001271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnconacional.odoo.com",nocase; classtype:attempted-recon; sid:200001272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bncre.odoo.com",nocase; classtype:attempted-recon; sid:200001273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bncswjd343546589dfui3wdfsdfsf.my-board.org",nocase; classtype:attempted-recon; sid:200001274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bndigitalpersonas.com",nocase; classtype:attempted-recon; sid:200001275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnsolicitudenlinea.com",nocase; classtype:attempted-recon; sid:200001276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnws.in",nocase; classtype:attempted-recon; sid:200001277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boaswp.com",nocase; classtype:attempted-recon; sid:200001278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boemena.com",nocase; classtype:attempted-recon; sid:200001279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bogdonovlerer.com",nocase; classtype:attempted-recon; sid:200001280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boiclub.com",nocase; classtype:attempted-recon; sid:200001281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-full-tante-nadia.duckdns.org",nocase; classtype:attempted-recon; sid:200001282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-terbaru-full-hd.duckdns.org",nocase; classtype:attempted-recon; sid:200001283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-xnxx7.jkub.com",nocase; classtype:attempted-recon; sid:200001284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokepress2020.dns2.us",nocase; classtype:attempted-recon; sid:200001285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bold-sinoussi.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200001286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bold-union-70b1.kamilawilliams.workers.dev",nocase; classtype:attempted-recon; sid:200001287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boldwhite.com",nocase; classtype:attempted-recon; sid:200001288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boliviaayudaa.blogspot.com",nocase; classtype:attempted-recon; sid:200001289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bolong3d.com",nocase; classtype:attempted-recon; sid:200001290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boma-ren.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bono350yanapay.acreditfood.digital",nocase; classtype:attempted-recon; sid:200001292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"book.uz",nocase; classtype:attempted-recon; sid:200001293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookedandboarding.com",nocase; classtype:attempted-recon; sid:200001294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookersbridge.com",nocase; classtype:attempted-recon; sid:200001295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookfbs.evangsamuelministries.com",nocase; classtype:attempted-recon; sid:200001296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking-pulse.com",nocase; classtype:attempted-recon; sid:200001297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booswk.com",nocase; classtype:attempted-recon; sid:200001298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"borgesemacedo.adv.br",nocase; classtype:attempted-recon; sid:200001299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosnewpaye.com",nocase; classtype:attempted-recon; sid:200001300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosquechispazos.com",nocase; classtype:attempted-recon; sid:200001301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosspandemicgrant.com",nocase; classtype:attempted-recon; sid:200001302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bottesdoc.my-free.website",nocase; classtype:attempted-recon; sid:200001303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boutiqueorange.cfd",nocase; classtype:attempted-recon; sid:200001304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bovicor.pl",nocase; classtype:attempted-recon; sid:200001305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"box1box129.wixsite.com",nocase; classtype:attempted-recon; sid:200001306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boxes.com.py",nocase; classtype:attempted-recon; sid:200001307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bperbanking.unaux.com",nocase; classtype:attempted-recon; sid:200001308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bpl.kr",nocase; classtype:attempted-recon; sid:200001309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br194.teste.website",nocase; classtype:attempted-recon; sid:200001310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br4.in",nocase; classtype:attempted-recon; sid:200001311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br5201312.xyz",nocase; classtype:attempted-recon; sid:200001312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br622.teste.website",nocase; classtype:attempted-recon; sid:200001313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"braccwe.com",nocase; classtype:attempted-recon; sid:200001314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bracows.com",nocase; classtype:attempted-recon; sid:200001315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bracshoe.com",nocase; classtype:attempted-recon; sid:200001316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradescnetempresas.ne12netempresarial.online",nocase; classtype:attempted-recon; sid:200001317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco.bloqueio-acesso.com",nocase; classtype:attempted-recon; sid:200001318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brannellyoutdoor.com.au",nocase; classtype:attempted-recon; sid:200001319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravepartner.com",nocase; classtype:attempted-recon; sid:200001320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brawcws.com",nocase; classtype:attempted-recon; sid:200001321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brawrds.com",nocase; classtype:attempted-recon; sid:200001322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brawygds.com",nocase; classtype:attempted-recon; sid:200001323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"breakingthelimits.com",nocase; classtype:attempted-recon; sid:200001324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"breople.com",nocase; classtype:attempted-recon; sid:200001325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brety-spin657.duckdns.org",nocase; classtype:attempted-recon; sid:200001326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridge.axie-lnfinity.com",nocase; classtype:attempted-recon; sid:200001327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brigida_cossette.gitlab.io",nocase; classtype:attempted-recon; sid:200001328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broacfe.com",nocase; classtype:attempted-recon; sid:200001329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broahs.com",nocase; classtype:attempted-recon; sid:200001330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broeaw.com",nocase; classtype:attempted-recon; sid:200001331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broken-breeze-52ae.eosprivate101.workers.dev",nocase; classtype:attempted-recon; sid:200001332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooks-southafrica.com",nocase; classtype:attempted-recon; sid:200001333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooks-trend.club",nocase; classtype:attempted-recon; sid:200001334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooks1984.shop",nocase; classtype:attempted-recon; sid:200001335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brookshoes.cc",nocase; classtype:attempted-recon; sid:200001336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brookssalenz.com",nocase; classtype:attempted-recon; sid:200001337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksshoessingapore.com",nocase; classtype:attempted-recon; sid:200001338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksusa.top",nocase; classtype:attempted-recon; sid:200001339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broowdea.com",nocase; classtype:attempted-recon; sid:200001340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brouhk.com",nocase; classtype:attempted-recon; sid:200001341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"browdfse.com",nocase; classtype:attempted-recon; sid:200001342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bruno-genthial.mykajabi.com",nocase; classtype:attempted-recon; sid:200001343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brwfeai.com",nocase; classtype:attempted-recon; sid:200001344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bshrocs.com",nocase; classtype:attempted-recon; sid:200001345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-100049.square.site",nocase; classtype:attempted-recon; sid:200001346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-100343.square.site",nocase; classtype:attempted-recon; sid:200001347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-102224.square.site",nocase; classtype:attempted-recon; sid:200001348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-102750.square.site",nocase; classtype:attempted-recon; sid:200001349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-104431.square.site",nocase; classtype:attempted-recon; sid:200001350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-104642.square.site",nocase; classtype:attempted-recon; sid:200001351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-105499.square.site",nocase; classtype:attempted-recon; sid:200001352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-105728.square.site",nocase; classtype:attempted-recon; sid:200001353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-105connectt.square.site",nocase; classtype:attempted-recon; sid:200001354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-106239.square.site",nocase; classtype:attempted-recon; sid:200001355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-108745.square.site",nocase; classtype:attempted-recon; sid:200001356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-109074.square.site",nocase; classtype:attempted-recon; sid:200001357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-administration.square.site",nocase; classtype:attempted-recon; sid:200001358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-classicmail-106479.square.site",nocase; classtype:attempted-recon; sid:200001359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-domainverification-108808-104447.square.site",nocase; classtype:attempted-recon; sid:200001360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-group-inc.square.site",nocase; classtype:attempted-recon; sid:200001361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-group-service.square.site",nocase; classtype:attempted-recon; sid:200001362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-offlceverification-107553-109696.square.site",nocase; classtype:attempted-recon; sid:200001363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-solution.square.site",nocase; classtype:attempted-recon; sid:200001364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-telecommunications-inc.square.site",nocase; classtype:attempted-recon; sid:200001365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btasbjbss.square.site",nocase; classtype:attempted-recon; sid:200001366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband45654378.boxmode.io",nocase; classtype:attempted-recon; sid:200001367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband45659090xx.boxmode.io",nocase; classtype:attempted-recon; sid:200001368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband980nfj.boxmode.io",nocase; classtype:attempted-recon; sid:200001369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands0938374746474.boxmode.io",nocase; classtype:attempted-recon; sid:200001370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands453122689.boxmode.io",nocase; classtype:attempted-recon; sid:200001371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands90874xx.boxmode.io",nocase; classtype:attempted-recon; sid:200001372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadyy02983pp.boxmode.io",nocase; classtype:attempted-recon; sid:200001373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbusinessbilling.wordpress.com",nocase; classtype:attempted-recon; sid:200001374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbusinesscommunicationss.weebly.com",nocase; classtype:attempted-recon; sid:200001375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btclickpreview365pdf.1msite.eu",nocase; classtype:attempted-recon; sid:200001376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btcominications.boxmode.io",nocase; classtype:attempted-recon; sid:200001377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnect-100567.square.site",nocase; classtype:attempted-recon; sid:200001378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnect-106223.square.site",nocase; classtype:attempted-recon; sid:200001379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnect-109798.square.site",nocase; classtype:attempted-recon; sid:200001380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnect-secure2021.weebly.com",nocase; classtype:attempted-recon; sid:200001381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectdacsdesrf.yolasite.com",nocase; classtype:attempted-recon; sid:200001382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxinupdatetdropboxpdf-logss.yolasite.com",nocase; classtype:attempted-recon; sid:200001383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxlinkupdatetdropboxpdf-logs.yolasite.com",nocase; classtype:attempted-recon; sid:200001384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomeloginpdropboxupdatepdf-logsssss-websit.yolasite.com",nocase; classtype:attempted-recon; sid:200001385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomesloginpdropboxupdatepdf-logsssss-websi.yolasite.com",nocase; classtype:attempted-recon; sid:200001386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btddidjdjdjdd.boxmode.io",nocase; classtype:attempted-recon; sid:200001387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btddok.cn",nocase; classtype:attempted-recon; sid:200001388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bthak.com",nocase; classtype:attempted-recon; sid:200001389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btincomingmailalertq7474444.boxmode.io",nocase; classtype:attempted-recon; sid:200001390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btinternet-123.square.site",nocase; classtype:attempted-recon; sid:200001391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btinternet.infinityfreeapp.com",nocase; classtype:attempted-recon; sid:200001392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btinternet7768.square.site",nocase; classtype:attempted-recon; sid:200001393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btinternetbroadbandz.boxmode.io",nocase; classtype:attempted-recon; sid:200001394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btmail02.weebly.com",nocase; classtype:attempted-recon; sid:200001395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btplcc.square.site",nocase; classtype:attempted-recon; sid:200001396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btsdkls.square.site",nocase; classtype:attempted-recon; sid:200001397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btsejrvicre.boxmode.io",nocase; classtype:attempted-recon; sid:200001398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btservererscf.boxmode.io",nocase; classtype:attempted-recon; sid:200001399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserverrf.boxmode.io",nocase; classtype:attempted-recon; sid:200001400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserverscvgh.boxmode.io",nocase; classtype:attempted-recon; sid:200001401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserversrscfed.boxmode.io",nocase; classtype:attempted-recon; sid:200001402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserversxmeixjf.boxmode.io",nocase; classtype:attempted-recon; sid:200001403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserveruytdrxf.boxmode.io",nocase; classtype:attempted-recon; sid:200001404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btservicre.boxmode.io",nocase; classtype:attempted-recon; sid:200001405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btt-onlineverify-102704-109431.square.site",nocase; classtype:attempted-recon; sid:200001406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btverificationalert3738383.boxmode.io",nocase; classtype:attempted-recon; sid:200001407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buildingtradesnetwork.com",nocase; classtype:attempted-recon; sid:200001408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"builmon.xyz",nocase; classtype:attempted-recon; sid:200001409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"builmonire.xyz",nocase; classtype:attempted-recon; sid:200001410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bujikena.web.app",nocase; classtype:attempted-recon; sid:200001411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buka.pemblokiran-facdebook.duckdns.org",nocase; classtype:attempted-recon; sid:200001412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bumiloka.com",nocase; classtype:attempted-recon; sid:200001413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"busanopen.org",nocase; classtype:attempted-recon; sid:200001414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"business-appeal-form-198275.web.app",nocase; classtype:attempted-recon; sid:200001415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"business-appeal-form-fb-1298.web.app",nocase; classtype:attempted-recon; sid:200001416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"businessemailss.biz",nocase; classtype:attempted-recon; sid:200001417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buxjvsd.bookofblue.eu",nocase; classtype:attempted-recon; sid:200001418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buyelectronicsnyc.com",nocase; classtype:attempted-recon; sid:200001419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buyonfiverr.xyz",nocase; classtype:attempted-recon; sid:200001420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bw-bank-online.u1491317.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200001421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bwithive.com",nocase; classtype:attempted-recon; sid:200001422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byentinfoterra.byethost7.com",nocase; classtype:attempted-recon; sid:200001423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byoko.co.kr",nocase; classtype:attempted-recon; sid:200001424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byrl.me",nocase; classtype:attempted-recon; sid:200001425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byygw.csb.app",nocase; classtype:attempted-recon; sid:200001426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bzrider.com",nocase; classtype:attempted-recon; sid:200001427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.curiousmorty.be",nocase; classtype:attempted-recon; sid:200001428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.jardindemiedo.es",nocase; classtype:attempted-recon; sid:200001429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.loveawaits.be",nocase; classtype:attempted-recon; sid:200001430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.mail.com",nocase; classtype:attempted-recon; sid:200001431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.na70.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200001432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.trofeominero.es",nocase; classtype:attempted-recon; sid:200001433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c0hbz754.caspio.com",nocase; classtype:attempted-recon; sid:200001434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c1400473.ferozo.com",nocase; classtype:attempted-recon; sid:200001435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c1970424.ferozo.com",nocase; classtype:attempted-recon; sid:200001436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c1v6zuixt5.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200001437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c2dc5b99.chgmar.pages.dev",nocase; classtype:attempted-recon; sid:200001438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c3cd5ac5.sibforms.com",nocase; classtype:attempted-recon; sid:200001439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c3i0y.cn",nocase; classtype:attempted-recon; sid:200001440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c5lws.app.link",nocase; classtype:attempted-recon; sid:200001441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c6ebl792.caspio.com",nocase; classtype:attempted-recon; sid:200001442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c6ebv708.caspio.com",nocase; classtype:attempted-recon; sid:200001443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c7811.wv2.masterbase.com",nocase; classtype:attempted-recon; sid:200001444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ca45645fggfi88.gb.net",nocase; classtype:attempted-recon; sid:200001445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cache.nebula.phx3.secureserver.net",nocase; classtype:attempted-recon; sid:200001446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cadacosaalseulloc.cresidusvo.info",nocase; classtype:attempted-recon; sid:200001447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cairoscan.com.eg",nocase; classtype:attempted-recon; sid:200001448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixa-gov.com",nocase; classtype:attempted-recon; sid:200001449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixaseguradora.quadientcloud.com",nocase; classtype:attempted-recon; sid:200001450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cakesbyannemotha.com",nocase; classtype:attempted-recon; sid:200001451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calm-bay-082938110.azurestaticapps.net",nocase; classtype:attempted-recon; sid:200001452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calm-star-dd66.se7enmiles64.workers.dev",nocase; classtype:attempted-recon; sid:200001453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calstatela.latefa-ahrrare.com",nocase; classtype:attempted-recon; sid:200001454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calsurv.com",nocase; classtype:attempted-recon; sid:200001455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvincooley.me",nocase; classtype:attempted-recon; sid:200001456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinindia.co.in",nocase; classtype:attempted-recon; sid:200001457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinsouthafrica.co.za",nocase; classtype:attempted-recon; sid:200001458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calzadosiris.com",nocase; classtype:attempted-recon; sid:200001459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camaieufr.commander1.com",nocase; classtype:attempted-recon; sid:200001460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camarapiracicaba.zyrosite.com",nocase; classtype:attempted-recon; sid:200001461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cambalkoncum.net",nocase; classtype:attempted-recon; sid:200001462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cambodiatraining.com",nocase; classtype:attempted-recon; sid:200001463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camperpuro.com",nocase; classtype:attempted-recon; sid:200001464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"candyrush.in",nocase; classtype:attempted-recon; sid:200001465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cannanedu.cn",nocase; classtype:attempted-recon; sid:200001466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cannellandcoflooring.co.uk",nocase; classtype:attempted-recon; sid:200001467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cantonsurgery.com",nocase; classtype:attempted-recon; sid:200001468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capholeful1978.blogspot.be",nocase; classtype:attempted-recon; sid:200001469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capitecapp.bank.sizakala.net",nocase; classtype:attempted-recon; sid:200001470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capservice.online",nocase; classtype:attempted-recon; sid:200001471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caracasmateriais.blogspot.com",nocase; classtype:attempted-recon; sid:200001472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cards-services-nl.45-81-232-15.plesk.page",nocase; classtype:attempted-recon; sid:200001473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carpediemxp.com",nocase; classtype:attempted-recon; sid:200001474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carskafunnyoly.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carwash.tv",nocase; classtype:attempted-recon; sid:200001476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casaapisoseacabamentos.com.br",nocase; classtype:attempted-recon; sid:200001477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casaverdeatelie.com",nocase; classtype:attempted-recon; sid:200001478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casazutilidades.com",nocase; classtype:attempted-recon; sid:200001479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caseforpage1000037402.web.app",nocase; classtype:attempted-recon; sid:200001480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caseforpage100022221.web.app",nocase; classtype:attempted-recon; sid:200001481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cash-365.live",nocase; classtype:attempted-recon; sid:200001482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cashbox.com.bd",nocase; classtype:attempted-recon; sid:200001483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cashflowfxonline.com",nocase; classtype:attempted-recon; sid:200001484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casinos.bg",nocase; classtype:attempted-recon; sid:200001485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casoamarillox949.byethost14.com",nocase; classtype:attempted-recon; sid:200001486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castennisacademy.be",nocase; classtype:attempted-recon; sid:200001487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castlemarne.com",nocase; classtype:attempted-recon; sid:200001488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cat-girl-claims-rewards-erc20-token.com",nocase; classtype:attempted-recon; sid:200001489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catalogue-orange.com",nocase; classtype:attempted-recon; sid:200001490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cater456harys.gb.net",nocase; classtype:attempted-recon; sid:200001491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caterin9302.byethost6.com",nocase; classtype:attempted-recon; sid:200001492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cateringfoodanddrinksupplies777.business.site",nocase; classtype:attempted-recon; sid:200001493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catherinehennig.com",nocase; classtype:attempted-recon; sid:200001494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catus.cat",nocase; classtype:attempted-recon; sid:200001495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cautionary-chips.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caycos.beispielseite-wmka.de",nocase; classtype:attempted-recon; sid:200001497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caymanreno.com",nocase; classtype:attempted-recon; sid:200001498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbkcares.org",nocase; classtype:attempted-recon; sid:200001499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbl57.csb.app",nocase; classtype:attempted-recon; sid:200001500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc41690.tmweb.ru",nocase; classtype:attempted-recon; sid:200001501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc76151.tmweb.ru",nocase; classtype:attempted-recon; sid:200001502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ccc.or.tz",nocase; classtype:attempted-recon; sid:200001503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cchomenurses.com",nocase; classtype:attempted-recon; sid:200001504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ccjrlaw.com",nocase; classtype:attempted-recon; sid:200001505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cd51044.tmweb.ru",nocase; classtype:attempted-recon; sid:200001506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cd80742.tmweb.ru",nocase; classtype:attempted-recon; sid:200001507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn-id.api-client-verifier.com",nocase; classtype:attempted-recon; sid:200001508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn-secure.auth2validation.online",nocase; classtype:attempted-recon; sid:200001509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn-secure.clouds-my-serv.com",nocase; classtype:attempted-recon; sid:200001510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.via.com",nocase; classtype:attempted-recon; sid:200001511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cea42u7sa1l.typeform.com",nocase; classtype:attempted-recon; sid:200001512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ceecoshippers.com",nocase; classtype:attempted-recon; sid:200001513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet2.blogspot.com",nocase; classtype:attempted-recon; sid:200001514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet88.blogspot.com",nocase; classtype:attempted-recon; sid:200001515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets.blogspot.com",nocase; classtype:attempted-recon; sid:200001516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets2020.blogspot.com",nocase; classtype:attempted-recon; sid:200001517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cema-fossano.it",nocase; classtype:attempted-recon; sid:200001518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centec-am.com.br",nocase; classtype:attempted-recon; sid:200001519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centericmailinwebs.wapka.website",nocase; classtype:attempted-recon; sid:200001520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"central.tagmarshal.com",nocase; classtype:attempted-recon; sid:200001521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centralconsulta.link",nocase; classtype:attempted-recon; sid:200001522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centralsuporteavc.comunidades.net",nocase; classtype:attempted-recon; sid:200001523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centre1.bubbleapps.io",nocase; classtype:attempted-recon; sid:200001524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centriccenteradmin.wapka.website",nocase; classtype:attempted-recon; sid:200001525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cero.pallkokesvvop.com",nocase; classtype:attempted-recon; sid:200001526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"certifica-montepaschii.com",nocase; classtype:attempted-recon; sid:200001527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cete-lem-fatura.net",nocase; classtype:attempted-recon; sid:200001528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cexclean.com",nocase; classtype:attempted-recon; sid:200001529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cf50l.csb.app",nocase; classtype:attempted-recon; sid:200001530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cf65477.tmweb.ru",nocase; classtype:attempted-recon; sid:200001531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cfre.hyperphp.com",nocase; classtype:attempted-recon; sid:200001532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cg-oe.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch-my-mtb.com",nocase; classtype:attempted-recon; sid:200001534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch-postfinance.com",nocase; classtype:attempted-recon; sid:200001535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.kontoportal.com",nocase; classtype:attempted-recon; sid:200001536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.marketing-gentleman.io",nocase; classtype:attempted-recon; sid:200001537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.net2care.com",nocase; classtype:attempted-recon; sid:200001538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.tcorner.fr",nocase; classtype:attempted-recon; sid:200001539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.v-update.com",nocase; classtype:attempted-recon; sid:200001540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaishaica.com",nocase; classtype:attempted-recon; sid:200001541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"changaosports.com",nocase; classtype:attempted-recon; sid:200001542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charlesdsmithlaw.com",nocase; classtype:attempted-recon; sid:200001543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charming-ptolemy.109-71-253-24.plesk.page",nocase; classtype:attempted-recon; sid:200001544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charperimagedesign.com",nocase; classtype:attempted-recon; sid:200001545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase-02a.web.app",nocase; classtype:attempted-recon; sid:200001546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase-com-home-page-site.cloudns.nz",nocase; classtype:attempted-recon; sid:200001547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase-verify01.cloudns.ph",nocase; classtype:attempted-recon; sid:200001548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase.messages3.bar",nocase; classtype:attempted-recon; sid:200001549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase01bsecureweb.cloudns.ph",nocase; classtype:attempted-recon; sid:200001550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase06secur.cloudns.ph",nocase; classtype:attempted-recon; sid:200001551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase0secure-2.app.link",nocase; classtype:attempted-recon; sid:200001552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase247bank.com",nocase; classtype:attempted-recon; sid:200001553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase4in.app.link",nocase; classtype:attempted-recon; sid:200001554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chasecare.cloudns.ph",nocase; classtype:attempted-recon; sid:200001555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaseonlinebilling1.cloudns.ph",nocase; classtype:attempted-recon; sid:200001556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chasesecure2522.cloudns.ph",nocase; classtype:attempted-recon; sid:200001557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chasesecureonline.cloudns.ph",nocase; classtype:attempted-recon; sid:200001558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chasesecureweb.cloudns.ph",nocase; classtype:attempted-recon; sid:200001559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatasapp.com",nocase; classtype:attempted-recon; sid:200001560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatasqp.com",nocase; classtype:attempted-recon; sid:200001561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp.doctorhaddadpediatriayflores.cl",nocase; classtype:attempted-recon; sid:200001562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp.vizvaz.com",nocase; classtype:attempted-recon; sid:200001563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp0.se.ke",nocase; classtype:attempted-recon; sid:200001564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsappgrupjoinbokepweb.zzux.com",nocase; classtype:attempted-recon; sid:200001565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsupp.com",nocase; classtype:attempted-recon; sid:200001566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chatdwasa.0-kj.se.ke",nocase; classtype:attempted-recon; sid:200001567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaturbate4.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaturbate7.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chatwhatsappgroups11.otzo.com",nocase; classtype:attempted-recon; sid:200001570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"check-newpayee-halfax.com",nocase; classtype:attempted-recon; sid:200001571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"checkpayroll.creatorlink.net",nocase; classtype:attempted-recon; sid:200001572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cherellll.fr",nocase; classtype:attempted-recon; sid:200001573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cherryleech.com",nocase; classtype:attempted-recon; sid:200001574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chikkuthomas.github.io",nocase; classtype:attempted-recon; sid:200001575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chinachamber.ca",nocase; classtype:attempted-recon; sid:200001576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chinmayavidyalayarspuram.com",nocase; classtype:attempted-recon; sid:200001577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chintamanibeachhouse.com",nocase; classtype:attempted-recon; sid:200001578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chiragrajoria.github.io",nocase; classtype:attempted-recon; sid:200001579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chirurgie-estetica.md",nocase; classtype:attempted-recon; sid:200001580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chois.jp",nocase; classtype:attempted-recon; sid:200001581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"choosefrombazar.com",nocase; classtype:attempted-recon; sid:200001582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chutomen.com",nocase; classtype:attempted-recon; sid:200001583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chvers1.cloudns.cl",nocase; classtype:attempted-recon; sid:200001584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci69056.tmweb.ru",nocase; classtype:attempted-recon; sid:200001585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ciet-itac.ca",nocase; classtype:attempted-recon; sid:200001586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cilerakinakdeniz.com",nocase; classtype:attempted-recon; sid:200001587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cimaclub.top",nocase; classtype:attempted-recon; sid:200001588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cincacakamancakaman.co.vu",nocase; classtype:attempted-recon; sid:200001589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citagestionenlineabn.com",nocase; classtype:attempted-recon; sid:200001590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citapreviacr.com",nocase; classtype:attempted-recon; sid:200001591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citemachineries.com",nocase; classtype:attempted-recon; sid:200001592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citi85banamex.com",nocase; classtype:attempted-recon; sid:200001593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citibankca-serveruser5-verify1a-account.cloudns.ph",nocase; classtype:attempted-recon; sid:200001594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citibankonliine.com",nocase; classtype:attempted-recon; sid:200001595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cities.ddnsking.com",nocase; classtype:attempted-recon; sid:200001596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citiverifyuser.duckdns.org",nocase; classtype:attempted-recon; sid:200001597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citizen01secure.ru",nocase; classtype:attempted-recon; sid:200001598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citizen04secure.ru",nocase; classtype:attempted-recon; sid:200001599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citizens01.secure32.ru",nocase; classtype:attempted-recon; sid:200001600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citizens3.secure40.ru",nocase; classtype:attempted-recon; sid:200001601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citizens3secure.ru",nocase; classtype:attempted-recon; sid:200001602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citlzen4.secure39.ru",nocase; classtype:attempted-recon; sid:200001603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"city-of-jazz.de",nocase; classtype:attempted-recon; sid:200001604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citycouncil-refund.com",nocase; classtype:attempted-recon; sid:200001605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cityoutlet.es",nocase; classtype:attempted-recon; sid:200001606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cjdoingthingz.com",nocase; classtype:attempted-recon; sid:200001607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckmadae.com",nocase; classtype:attempted-recon; sid:200001608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckwgruppe.service-now.com",nocase; classtype:attempted-recon; sid:200001609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cl71685.tmweb.ru",nocase; classtype:attempted-recon; sid:200001610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cla2020gov.com",nocase; classtype:attempted-recon; sid:200001611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim-event-ff654.duckdns.org",nocase; classtype:attempted-recon; sid:200001612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim-event-pubg-terbaru-gratis-2021.duckdns.org",nocase; classtype:attempted-recon; sid:200001613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimitembundleff87.duckdns.org",nocase; classtype:attempted-recon; sid:200001614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimitoning.my.id",nocase; classtype:attempted-recon; sid:200001615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claims-funds-enczj.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claro-link.brsafe.com.br",nocase; classtype:attempted-recon; sid:200001617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"class12.cn",nocase; classtype:attempted-recon; sid:200001618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"classics-plus.com",nocase; classtype:attempted-recon; sid:200001619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claus.bz",nocase; classtype:attempted-recon; sid:200001620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clearstageconsulting.com",nocase; classtype:attempted-recon; sid:200001621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clejohn.hyperphp.com",nocase; classtype:attempted-recon; sid:200001622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clemensrau.de",nocase; classtype:attempted-recon; sid:200001623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.em32dat.eu",nocase; classtype:attempted-recon; sid:200001624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"client.server.management.37-0-10-62.plesk.page",nocase; classtype:attempted-recon; sid:200001625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientebnreserva.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientescaixa.duckdns.org",nocase; classtype:attempted-recon; sid:200001627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientesyscaixa4.10001mb.com",nocase; classtype:attempted-recon; sid:200001628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientquest.quest",nocase; classtype:attempted-recon; sid:200001629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clients.devtux.com",nocase; classtype:attempted-recon; sid:200001630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clone-7473c.web.app",nocase; classtype:attempted-recon; sid:200001631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"closingdocs9480.myportfolio.com",nocase; classtype:attempted-recon; sid:200001632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud-object-storage-o9-cos-static-web-hocsx2.pages.dev",nocase; classtype:attempted-recon; sid:200001633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud.go4clients.com",nocase; classtype:attempted-recon; sid:200001634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud102.hostgator.com",nocase; classtype:attempted-recon; sid:200001635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudflare-rbnuo.run.goorm.io",nocase; classtype:attempted-recon; sid:200001637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudshare-account-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudsraindrop.com",nocase; classtype:attempted-recon; sid:200001639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudtracker.com.br",nocase; classtype:attempted-recon; sid:200001640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clt1234529.bmetrack.com",nocase; classtype:attempted-recon; sid:200001641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clt1371667.bmetrack.com",nocase; classtype:attempted-recon; sid:200001642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"club-healthylifestyle.com",nocase; classtype:attempted-recon; sid:200001643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clubeamigosdopedrosegundo.com.br",nocase; classtype:attempted-recon; sid:200001644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clumsycooks.com.au",nocase; classtype:attempted-recon; sid:200001645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clusterfuckly.com",nocase; classtype:attempted-recon; sid:200001646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clxitatey.com",nocase; classtype:attempted-recon; sid:200001647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clz.ekc.mybluehost.me",nocase; classtype:attempted-recon; sid:200001648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cm08814.tmweb.ru",nocase; classtype:attempted-recon; sid:200001649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cmciasi.ro",nocase; classtype:attempted-recon; sid:200001650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cner283829.odoo.com",nocase; classtype:attempted-recon; sid:200001651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnl.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnn.cloudns.ph",nocase; classtype:attempted-recon; sid:200001653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.69ouioeq.cn",nocase; classtype:attempted-recon; sid:200001654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.79hv2rxuq.cn",nocase; classtype:attempted-recon; sid:200001655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.bafyjcz.cn",nocase; classtype:attempted-recon; sid:200001656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.bfss9p.cn",nocase; classtype:attempted-recon; sid:200001657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.gzwht.cn",nocase; classtype:attempted-recon; sid:200001658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.hsxhx.cn",nocase; classtype:attempted-recon; sid:200001659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.ktbohe.cn",nocase; classtype:attempted-recon; sid:200001660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.m7lq.cn",nocase; classtype:attempted-recon; sid:200001661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.mgt0iz9z.cn",nocase; classtype:attempted-recon; sid:200001662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.nhgdks.cn",nocase; classtype:attempted-recon; sid:200001663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.oue70l.cn",nocase; classtype:attempted-recon; sid:200001664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.p9fh8q.cn",nocase; classtype:attempted-recon; sid:200001665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.psndhz.cn",nocase; classtype:attempted-recon; sid:200001666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.soru123.cn",nocase; classtype:attempted-recon; sid:200001667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.ss17580.cn",nocase; classtype:attempted-recon; sid:200001668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.virther.cn",nocase; classtype:attempted-recon; sid:200001669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.w1490.cn",nocase; classtype:attempted-recon; sid:200001670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.wajihu.cn",nocase; classtype:attempted-recon; sid:200001671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.xcqi7z75.cn",nocase; classtype:attempted-recon; sid:200001672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.xmaizi.cn",nocase; classtype:attempted-recon; sid:200001673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.yfxafmy.cn",nocase; classtype:attempted-recon; sid:200001674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.zby9in.cn",nocase; classtype:attempted-recon; sid:200001675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.zheimen.cn",nocase; classtype:attempted-recon; sid:200001676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coanwilliams.com",nocase; classtype:attempted-recon; sid:200001677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cocovip.net",nocase; classtype:attempted-recon; sid:200001678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashop-ph2020.ezua.com",nocase; classtype:attempted-recon; sid:200001679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codeblue.ch.net2care.com",nocase; classtype:attempted-recon; sid:200001680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codecertifiedinspector.com",nocase; classtype:attempted-recon; sid:200001681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codorasys.com",nocase; classtype:attempted-recon; sid:200001682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coincheck-137bc.web.app",nocase; classtype:attempted-recon; sid:200001683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coinly.cz",nocase; classtype:attempted-recon; sid:200001684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colegiojapam.edu.pe",nocase; classtype:attempted-recon; sid:200001685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"collaboratiion.com",nocase; classtype:attempted-recon; sid:200001686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colorfastinv.com",nocase; classtype:attempted-recon; sid:200001687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiapolska.com",nocase; classtype:attempted-recon; sid:200001688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"combinaststudio.info",nocase; classtype:attempted-recon; sid:200001689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comboniane.org",nocase; classtype:attempted-recon; sid:200001690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comdiirect.xyz",nocase; classtype:attempted-recon; sid:200001691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comidkenya.org",nocase; classtype:attempted-recon; sid:200001692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comigocombr.creatorlink.net",nocase; classtype:attempted-recon; sid:200001693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"commandes.site",nocase; classtype:attempted-recon; sid:200001694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communicationfixe3900.dorik.io",nocase; classtype:attempted-recon; sid:200001695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-diskussionsforen-probleme-klaren-de.totalh.net",nocase; classtype:attempted-recon; sid:200001696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-forum-clubs-de.html-5.me",nocase; classtype:attempted-recon; sid:200001697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t5-discussions-forum.html-5.me",nocase; classtype:attempted-recon; sid:200001698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t6-discussions-forum.22web.org",nocase; classtype:attempted-recon; sid:200001699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t7-discussions-forum.html-5.me",nocase; classtype:attempted-recon; sid:200001700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-01138913366342885284.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-12801302126217973708.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-28202553629866144006.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-31663102143893079967.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-44883444930165123303.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-84867768333344441273.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-87311170493185500542.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-99558416152942940161.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communitytrustbnk.com",nocase; classtype:attempted-recon; sid:200001709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"compatibilita-area-web.com",nocase; classtype:attempted-recon; sid:200001710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"compliancetrk.com",nocase; classtype:attempted-recon; sid:200001711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comprensivomarrosso.edu.it",nocase; classtype:attempted-recon; sid:200001712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunicazioniarubait.tumblr.com",nocase; classtype:attempted-recon; sid:200001713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-19.web.id",nocase; classtype:attempted-recon; sid:200001714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-29.web.id",nocase; classtype:attempted-recon; sid:200001715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-33.web.id",nocase; classtype:attempted-recon; sid:200001716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-88.web.id",nocase; classtype:attempted-recon; sid:200001717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"con-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"condescending-chaplygin.23-94-50-242.plesk.page",nocase; classtype:attempted-recon; sid:200001719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conferma-format-card.com",nocase; classtype:attempted-recon; sid:200001720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"configuration.insecur-page.workers.dev",nocase; classtype:attempted-recon; sid:200001721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-my-newpayments.com",nocase; classtype:attempted-recon; sid:200001722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-mynew-tranfers.com",nocase; classtype:attempted-recon; sid:200001723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-mynew-transactions.com",nocase; classtype:attempted-recon; sid:200001724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-newpayments.com",nocase; classtype:attempted-recon; sid:200001725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-your-new-payee.com",nocase; classtype:attempted-recon; sid:200001726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmaci0n3007.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmati0nwe0b.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmationssan.hostfree.pw",nocase; classtype:attempted-recon; sid:200001729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmleboncoin.ru",nocase; classtype:attempted-recon; sid:200001730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmpayment.cf",nocase; classtype:attempted-recon; sid:200001731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmsrevielapps.ml",nocase; classtype:attempted-recon; sid:200001732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confused.servegame.com",nocase; classtype:attempted-recon; sid:200001733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"congresosba.com.ar",nocase; classtype:attempted-recon; sid:200001734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connect.secur-wellsfargo.com.verify-identy.duckdns.org",nocase; classtype:attempted-recon; sid:200001735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connectdapps.com",nocase; classtype:attempted-recon; sid:200001736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connectingsouls.co.in",nocase; classtype:attempted-recon; sid:200001737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connectwalletsdapps.com",nocase; classtype:attempted-recon; sid:200001738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connexion-compte-client.freeweb.pk",nocase; classtype:attempted-recon; sid:200001739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consswap.top",nocase; classtype:attempted-recon; sid:200001740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consulting-gvg.com",nocase; classtype:attempted-recon; sid:200001741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contabilidaderabello.com.br",nocase; classtype:attempted-recon; sid:200001742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contact-ronin.com",nocase; classtype:attempted-recon; sid:200001743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contact2acceptpoilcyverifingyouracceptancemailfullinbox.pages.dev",nocase; classtype:attempted-recon; sid:200001744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactronin.com",nocase; classtype:attempted-recon; sid:200001745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contapessoal.digital",nocase; classtype:attempted-recon; sid:200001746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contatoparareparo.cf",nocase; classtype:attempted-recon; sid:200001747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.av1.com.au",nocase; classtype:attempted-recon; sid:200001748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.meetmagic.org",nocase; classtype:attempted-recon; sid:200001749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.rmhc.org.nz",nocase; classtype:attempted-recon; sid:200001750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.warakirri.com.au",nocase; classtype:attempted-recon; sid:200001751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contorese.org",nocase; classtype:attempted-recon; sid:200001752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contractordoc.com",nocase; classtype:attempted-recon; sid:200001753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contratodeparceria.com.br",nocase; classtype:attempted-recon; sid:200001754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contratoenlinea.com",nocase; classtype:attempted-recon; sid:200001755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"controlepanelbw.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200001756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"controllo-utenti-bs.com",nocase; classtype:attempted-recon; sid:200001757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coolbuyph.com",nocase; classtype:attempted-recon; sid:200001758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coollube.co.in",nocase; classtype:attempted-recon; sid:200001759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coolstool.net",nocase; classtype:attempted-recon; sid:200001760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"copyright-appeal-form.web.app",nocase; classtype:attempted-recon; sid:200001761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corinnakegel.com",nocase; classtype:attempted-recon; sid:200001762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corporacionbeeo.com",nocase; classtype:attempted-recon; sid:200001763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corsipercorrispondenza.com",nocase; classtype:attempted-recon; sid:200001764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corta.ai",nocase; classtype:attempted-recon; sid:200001765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cosemu.com",nocase; classtype:attempted-recon; sid:200001766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cosmicmicrowavebackgroundradiation.us",nocase; classtype:attempted-recon; sid:200001767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"costpify.com",nocase; classtype:attempted-recon; sid:200001768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cottonwooddentalg.nimbusweb.me",nocase; classtype:attempted-recon; sid:200001769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"couchtattie.co.uk",nocase; classtype:attempted-recon; sid:200001770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courseworkwritingsite.com",nocase; classtype:attempted-recon; sid:200001771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courtcase.co.in",nocase; classtype:attempted-recon; sid:200001772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coutruoms-davipluhome4.eb2a.com",nocase; classtype:attempted-recon; sid:200001773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covaricambi.it",nocase; classtype:attempted-recon; sid:200001774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-19challengecoin.com",nocase; classtype:attempted-recon; sid:200001775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-foyyn.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cox0.yolasite.com",nocase; classtype:attempted-recon; sid:200001777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coxmartirj.weebly.com",nocase; classtype:attempted-recon; sid:200001778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coxsignningg.weebly.com",nocase; classtype:attempted-recon; sid:200001779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cp45362.tmweb.ru",nocase; classtype:attempted-recon; sid:200001780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel.thepsychedelics.net",nocase; classtype:attempted-recon; sid:200001781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel10wh.bkk1.cloud.z.com",nocase; classtype:attempted-recon; sid:200001782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpbsupplychain.com.au",nocase; classtype:attempted-recon; sid:200001783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpc-lda.co",nocase; classtype:attempted-recon; sid:200001784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpc.cx",nocase; classtype:attempted-recon; sid:200001785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpu30691.mfs.gg",nocase; classtype:attempted-recon; sid:200001788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cr-mufg.co",nocase; classtype:attempted-recon; sid:200001789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cranetech.com.br",nocase; classtype:attempted-recon; sid:200001790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crazinerd.com",nocase; classtype:attempted-recon; sid:200001791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crazyindiandeals.com",nocase; classtype:attempted-recon; sid:200001792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"create-case.com",nocase; classtype:attempted-recon; sid:200001793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creative-console.com",nocase; classtype:attempted-recon; sid:200001794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credcloud-object-storage-o9-cos-static-web-hocsd3d.pages.dev",nocase; classtype:attempted-recon; sid:200001795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credicorp-capital.net",nocase; classtype:attempted-recon; sid:200001796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credicorpfiduciariasa.com",nocase; classtype:attempted-recon; sid:200001797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credifinanciera.didacsis.com",nocase; classtype:attempted-recon; sid:200001798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crediserfinanza.com",nocase; classtype:attempted-recon; sid:200001799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditagricole.zyrosite.com",nocase; classtype:attempted-recon; sid:200001800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.it",nocase; classtype:attempted-recon; sid:200001801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditopessoalitau.com",nocase; classtype:attempted-recon; sid:200001802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditsuisse-newclientpromotion.com",nocase; classtype:attempted-recon; sid:200001803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credix.finance",nocase; classtype:attempted-recon; sid:200001804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cresvin.com",nocase; classtype:attempted-recon; sid:200001805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crfm-on.rf.gd",nocase; classtype:attempted-recon; sid:200001806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cricketminnaar.com",nocase; classtype:attempted-recon; sid:200001807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cristalcheco.es",nocase; classtype:attempted-recon; sid:200001808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cristinamambrini.com.br",nocase; classtype:attempted-recon; sid:200001809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"criticalcarevizag.com",nocase; classtype:attempted-recon; sid:200001810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crm.hk-handel.com",nocase; classtype:attempted-recon; sid:200001811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crmlavoz.lavozdelinterior.net",nocase; classtype:attempted-recon; sid:200001812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cronologiabacw.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crossfit-rennes.fr",nocase; classtype:attempted-recon; sid:200001814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crpmoney.com",nocase; classtype:attempted-recon; sid:200001815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crroweb.emiweb.es",nocase; classtype:attempted-recon; sid:200001816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crueltybyclaire.com",nocase; classtype:attempted-recon; sid:200001817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cryptosecurefx.com",nocase; classtype:attempted-recon; sid:200001818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cryptosmartbeta.com",nocase; classtype:attempted-recon; sid:200001819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csemergencylock.typeform.com",nocase; classtype:attempted-recon; sid:200001820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csgoampire.com",nocase; classtype:attempted-recon; sid:200001821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csgofloat.pro",nocase; classtype:attempted-recon; sid:200001822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csgorun.shop",nocase; classtype:attempted-recon; sid:200001823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cslanet.ghalisdestock.ma",nocase; classtype:attempted-recon; sid:200001824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csmnvey.com",nocase; classtype:attempted-recon; sid:200001825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csob.cz-cloud.xyz",nocase; classtype:attempted-recon; sid:200001826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cspacks-agro.sbs",nocase; classtype:attempted-recon; sid:200001827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csss.co.jp",nocase; classtype:attempted-recon; sid:200001828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ct70312.tmweb.ru",nocase; classtype:attempted-recon; sid:200001829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ctt-correios-de-portugal-shippingexpress.com",nocase; classtype:attempted-recon; sid:200001830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cu02639.tmweb.ru",nocase; classtype:attempted-recon; sid:200001831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cu41986.tmweb.ru",nocase; classtype:attempted-recon; sid:200001832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cubeadministrator.live",nocase; classtype:attempted-recon; sid:200001833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cuenta0bloqueada.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cuevadehombre.com",nocase; classtype:attempted-recon; sid:200001835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"current-development.b-cdn.net",nocase; classtype:attempted-recon; sid:200001836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlyattserver00321.weebly.com",nocase; classtype:attempted-recon; sid:200001837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlyattserver444.weebly.com",nocase; classtype:attempted-recon; sid:200001838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlycom.odoo.com",nocase; classtype:attempted-recon; sid:200001839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlyfromattverificationupdate1.weebly.com",nocase; classtype:attempted-recon; sid:200001840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cursuri-sooraj.ro",nocase; classtype:attempted-recon; sid:200001841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-1841.com",nocase; classtype:attempted-recon; sid:200001842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-1845.com",nocase; classtype:attempted-recon; sid:200001843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-1847.com",nocase; classtype:attempted-recon; sid:200001844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-1849.com",nocase; classtype:attempted-recon; sid:200001845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-27301.com",nocase; classtype:attempted-recon; sid:200001846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-ebay.com",nocase; classtype:attempted-recon; sid:200001847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-verification-service.cloudns.asia",nocase; classtype:attempted-recon; sid:200001848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer.paypal.restored.cemaco.vn",nocase; classtype:attempted-recon; sid:200001849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customerpruef01.xyz",nocase; classtype:attempted-recon; sid:200001850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customerpruef012.xyz",nocase; classtype:attempted-recon; sid:200001851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customerpruef0143.xyz",nocase; classtype:attempted-recon; sid:200001852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"custommotorcyclecover.com",nocase; classtype:attempted-recon; sid:200001853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cut.li",nocase; classtype:attempted-recon; sid:200001854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cvd19logappscruty.cloudns.cl",nocase; classtype:attempted-recon; sid:200001855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cvkry.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cvxxceude.web.app",nocase; classtype:attempted-recon; sid:200001857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cxmx2020atualizacao.com",nocase; classtype:attempted-recon; sid:200001858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy27197.tmweb.ru",nocase; classtype:attempted-recon; sid:200001859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy7xlpjaxh8.typeform.com",nocase; classtype:attempted-recon; sid:200001860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cyalsdl.bookofblue.eu",nocase; classtype:attempted-recon; sid:200001861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cybersolution.eu",nocase; classtype:attempted-recon; sid:200001862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cyrela-imoveis.blogspot.com",nocase; classtype:attempted-recon; sid:200001863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz0centrum.com",nocase; classtype:attempted-recon; sid:200001864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz84.webeden.co.uk",nocase; classtype:attempted-recon; sid:200001865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czechineseauction.com",nocase; classtype:attempted-recon; sid:200001866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czsantand3.byethost7.com",nocase; classtype:attempted-recon; sid:200001867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czywja.cn",nocase; classtype:attempted-recon; sid:200001868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d-hlsa.bem.com.ng",nocase; classtype:attempted-recon; sid:200001869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d16hdrba6dusey.clouldfront.net",nocase; classtype:attempted-recon; sid:200001870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d18gc1ytkdv37u.cloudfront.net",nocase; classtype:attempted-recon; sid:200001871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d1yjjnpx0p53s8.cloudfront.net",nocase; classtype:attempted-recon; sid:200001872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d2aae6a6.srvr-cloudmail-srvr675eu6r.pages.dev",nocase; classtype:attempted-recon; sid:200001873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d38ff0bf.ithemeshosting.com.php73-40.lan3-1.websitetestlink.com",nocase; classtype:attempted-recon; sid:200001874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d3ncuwwrr82.typeform.com",nocase; classtype:attempted-recon; sid:200001875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d521e3ba-0de3-4eae-a9a8-bafefca61eda.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200001876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d5wxk.csb.app",nocase; classtype:attempted-recon; sid:200001877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d9tx1w.cn",nocase; classtype:attempted-recon; sid:200001878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dadagency.in",nocase; classtype:attempted-recon; sid:200001879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dadmin8.cn",nocase; classtype:attempted-recon; sid:200001880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daffodil-believed-blackberry.glitch.me",nocase; classtype:attempted-recon; sid:200001881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dag-mot-lan.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dailyexclusiveoffer.com",nocase; classtype:attempted-recon; sid:200001883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dainellistudio.eu",nocase; classtype:attempted-recon; sid:200001884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dainmigration.com",nocase; classtype:attempted-recon; sid:200001885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daivamahiti.com",nocase; classtype:attempted-recon; sid:200001886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dalatngaynay.com",nocase; classtype:attempted-recon; sid:200001887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"damp-cell-9f51.dhlupdatedblurnt.workers.dev",nocase; classtype:attempted-recon; sid:200001888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"damp-f43e.recovery-page-secur.workers.dev",nocase; classtype:attempted-recon; sid:200001889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daniel-treufeld.de",nocase; classtype:attempted-recon; sid:200001890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danielescivoli.it",nocase; classtype:attempted-recon; sid:200001891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daniellygolden.com",nocase; classtype:attempted-recon; sid:200001892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danielwritingportfolio.com",nocase; classtype:attempted-recon; sid:200001893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danitraseoexperts.com",nocase; classtype:attempted-recon; sid:200001894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dappsmergers.org",nocase; classtype:attempted-recon; sid:200001895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dappydog.com",nocase; classtype:attempted-recon; sid:200001896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darah.com.br",nocase; classtype:attempted-recon; sid:200001897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daressalaamtextilemills.com",nocase; classtype:attempted-recon; sid:200001898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darmowe-tankowanie.click",nocase; classtype:attempted-recon; sid:200001899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dash4.niswaps.sbs",nocase; classtype:attempted-recon; sid:200001900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dataupdaterequired.site44.com",nocase; classtype:attempted-recon; sid:200001901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dataworld.at",nocase; classtype:attempted-recon; sid:200001902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"date-in.rf.gd",nocase; classtype:attempted-recon; sid:200001903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"datelsolutions.co.uk",nocase; classtype:attempted-recon; sid:200001904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daten-und-security-spk.com",nocase; classtype:attempted-recon; sid:200001905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"datenschutz-endkdunden-spk-de.com",nocase; classtype:attempted-recon; sid:200001906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"datenshutz-spk-eu.com",nocase; classtype:attempted-recon; sid:200001907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"david-held.com",nocase; classtype:attempted-recon; sid:200001908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daycoval.contrato.srv.br",nocase; classtype:attempted-recon; sid:200001909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dazul.com.ar",nocase; classtype:attempted-recon; sid:200001910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbesmdcjzturhizszllesbthsn-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs-ban.com",nocase; classtype:attempted-recon; sid:200001912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs-ssf.com",nocase; classtype:attempted-recon; sid:200001913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs-ssr.com",nocase; classtype:attempted-recon; sid:200001914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.iensrt.com",nocase; classtype:attempted-recon; sid:200001915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.inteatnet.com",nocase; classtype:attempted-recon; sid:200001916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.intestnet.com",nocase; classtype:attempted-recon; sid:200001917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.intrse.com",nocase; classtype:attempted-recon; sid:200001918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.intsatnet.com",nocase; classtype:attempted-recon; sid:200001919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.intsrt.com",nocase; classtype:attempted-recon; sid:200001920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.mc.eu1.kontiki.com",nocase; classtype:attempted-recon; sid:200001921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.surgegoldibank.online",nocase; classtype:attempted-recon; sid:200001922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dcm1.ae.iwc.static.tungmung.co.id",nocase; classtype:attempted-recon; sid:200001923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dd90001.github.io",nocase; classtype:attempted-recon; sid:200001924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"de-disney-plus.com",nocase; classtype:attempted-recon; sid:200001925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deactivemsnon-8k98-l9k8-98j8-98j78u.pages.dev",nocase; classtype:attempted-recon; sid:200001926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dealerzone.greatnortherncabinetry.com",nocase; classtype:attempted-recon; sid:200001927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deapplemoundo.blogspot.com",nocase; classtype:attempted-recon; sid:200001928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dearcustomers.toonlineamazoncardpresence.one",nocase; classtype:attempted-recon; sid:200001929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deborahholland.net",nocase; classtype:attempted-recon; sid:200001930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decaturilbgc.com",nocase; classtype:attempted-recon; sid:200001931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declicgestion.fr",nocase; classtype:attempted-recon; sid:200001932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declined-myaccount.com",nocase; classtype:attempted-recon; sid:200001933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decorcenter.com.pe",nocase; classtype:attempted-recon; sid:200001934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ded3544.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200001935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dedicadoservidorcax.joomla.com",nocase; classtype:attempted-recon; sid:200001936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dedicatedpasswor.byethost9.com",nocase; classtype:attempted-recon; sid:200001937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deeperlifezambia.org",nocase; classtype:attempted-recon; sid:200001938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deerectus.com",nocase; classtype:attempted-recon; sid:200001939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deficitdeatencionperu.com",nocase; classtype:attempted-recon; sid:200001940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deinspkservice.com",nocase; classtype:attempted-recon; sid:200001941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dejpaad.com",nocase; classtype:attempted-recon; sid:200001942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dekasse-berliner.blogspot.com",nocase; classtype:attempted-recon; sid:200001943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delezhen.mashalezhen.com",nocase; classtype:attempted-recon; sid:200001944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delgtr.hyperphp.com",nocase; classtype:attempted-recon; sid:200001945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delhiescort69.com",nocase; classtype:attempted-recon; sid:200001946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delicatesedelici.byethost7.com",nocase; classtype:attempted-recon; sid:200001947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delightontour.com",nocase; classtype:attempted-recon; sid:200001948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delivery-support-menu.com",nocase; classtype:attempted-recon; sid:200001949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deliveryatplace.com",nocase; classtype:attempted-recon; sid:200001950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deljenjeflajera.com",nocase; classtype:attempted-recon; sid:200001951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delta.flightstatalert.com",nocase; classtype:attempted-recon; sid:200001952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deltaflights.org",nocase; classtype:attempted-recon; sid:200001953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deltaflugschule.ch",nocase; classtype:attempted-recon; sid:200001954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deltageophysics.com",nocase; classtype:attempted-recon; sid:200001955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demallplot-tra.web.app",nocase; classtype:attempted-recon; sid:200001956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demiregalos.com.ar",nocase; classtype:attempted-recon; sid:200001957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.bradescocontrol.vertitecnologia.com.br",nocase; classtype:attempted-recon; sid:200001958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.prunescape.com.au",nocase; classtype:attempted-recon; sid:200001959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.samretpechfinance.com",nocase; classtype:attempted-recon; sid:200001960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demobilv.xyz",nocase; classtype:attempted-recon; sid:200001961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"den-brogede-verden.dk",nocase; classtype:attempted-recon; sid:200001962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denartcc.org",nocase; classtype:attempted-recon; sid:200001963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denizmessebau.com",nocase; classtype:attempted-recon; sid:200001964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denuihuongson.com.vn",nocase; classtype:attempted-recon; sid:200001965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deny-application-access.com",nocase; classtype:attempted-recon; sid:200001966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-lbpayee.com",nocase; classtype:attempted-recon; sid:200001967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-lloyd-unauthorisedaccess.com",nocase; classtype:attempted-recon; sid:200001968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-unverified-seclloyd.com",nocase; classtype:attempted-recon; sid:200001969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derfs.hyperphp.com",nocase; classtype:attempted-recon; sid:200001970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derlambank.com",nocase; classtype:attempted-recon; sid:200001971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"design101.com.br",nocase; classtype:attempted-recon; sid:200001972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designandcraftsmanship.com",nocase; classtype:attempted-recon; sid:200001973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designerlakehouse.com",nocase; classtype:attempted-recon; sid:200001974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"detcgcvbzjyipjeadvangqrccfhwqv.66ghz.com",nocase; classtype:attempted-recon; sid:200001975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"detect-new-payee.com",nocase; classtype:attempted-recon; sid:200001976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"determined-chandrasekhar.107-174-50-164.plesk.page",nocase; classtype:attempted-recon; sid:200001977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deutb4zjaod0a.flywheelsites.com",nocase; classtype:attempted-recon; sid:200001978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-interfacemail.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-nadaj.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-secu-credit-union.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-www.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.belinqed.nl",nocase; classtype:attempted-recon; sid:200001983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.ei-ie.org",nocase; classtype:attempted-recon; sid:200001984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.prunescape.com.au",nocase; classtype:attempted-recon; sid:200001985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.shivaxi.com",nocase; classtype:attempted-recon; sid:200001986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"devialn.com",nocase; classtype:attempted-recon; sid:200001987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deviconfermareiltuonumeroditelefono.hollings.it",nocase; classtype:attempted-recon; sid:200001988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dexlerholdings.com",nocase; classtype:attempted-recon; sid:200001989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dezautosam.ro",nocase; classtype:attempted-recon; sid:200001990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfastpass.com",nocase; classtype:attempted-recon; sid:200001991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfghjkgvhjklghj.weebly.com",nocase; classtype:attempted-recon; sid:200001992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfghjkjhgfdfghjk.boxmode.io",nocase; classtype:attempted-recon; sid:200001993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfjdfhgfdfhjfg.square.site",nocase; classtype:attempted-recon; sid:200001994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dg54asdg15g1.agilecrm.com",nocase; classtype:attempted-recon; sid:200001995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dgfchdjwcf.zyrosite.com",nocase; classtype:attempted-recon; sid:200001996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dghunzmyii.duckdns.org",nocase; classtype:attempted-recon; sid:200001997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dgsols.com",nocase; classtype:attempted-recon; sid:200001998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhanushr24.github.io",nocase; classtype:attempted-recon; sid:200001999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-event.app",nocase; classtype:attempted-recon; sid:200002000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-ru.com",nocase; classtype:attempted-recon; sid:200002001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl.recruitmentplatform.com",nocase; classtype:attempted-recon; sid:200002002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhlgpi.com",nocase; classtype:attempted-recon; sid:200002003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diamond-group.ru",nocase; classtype:attempted-recon; sid:200002004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diantonoidaccapp.rf.gd",nocase; classtype:attempted-recon; sid:200002005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"die-post-swiss-id-19782635812.psd2any.com",nocase; classtype:attempted-recon; sid:200002006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diejsjsfshfsfkjsfhsdfjdfrfgtjthgjgdfbsdshgvb.my-board.org",nocase; classtype:attempted-recon; sid:200002007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diepostversand.cargo.site",nocase; classtype:attempted-recon; sid:200002008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"difficult-enchanting-outrigger.glitch.me",nocase; classtype:attempted-recon; sid:200002009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diginto.org",nocase; classtype:attempted-recon; sid:200002010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digisails.org",nocase; classtype:attempted-recon; sid:200002011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digital-times.biz",nocase; classtype:attempted-recon; sid:200002012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitalkarachi.pk",nocase; classtype:attempted-recon; sid:200002013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitaltaxmatters.co.uk",nocase; classtype:attempted-recon; sid:200002014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dik.si",nocase; classtype:attempted-recon; sid:200002015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dimolo.activehosted.com",nocase; classtype:attempted-recon; sid:200002016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dineroalinstante.pe",nocase; classtype:attempted-recon; sid:200002017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dineroalinstantesbcp.com",nocase; classtype:attempted-recon; sid:200002018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dip-audit.ru",nocase; classtype:attempted-recon; sid:200002019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directdownloadserviceplus.com",nocase; classtype:attempted-recon; sid:200002020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directlighting.es",nocase; classtype:attempted-recon; sid:200002021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directly.serveirc.com",nocase; classtype:attempted-recon; sid:200002022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directric5.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200002023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directsites.site44.com",nocase; classtype:attempted-recon; sid:200002024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directsmbc.net",nocase; classtype:attempted-recon; sid:200002025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discordgifts.ru.com",nocase; classtype:attempted-recon; sid:200002026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discordpromotions.cc",nocase; classtype:attempted-recon; sid:200002027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disgrace.ddnsking.com",nocase; classtype:attempted-recon; sid:200002028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disk.alwaysdata.net",nocase; classtype:attempted-recon; sid:200002029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diskussionsforen-ebay-de.test105227.test-account.com",nocase; classtype:attempted-recon; sid:200002030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disneyplusfreetrial.co.uk",nocase; classtype:attempted-recon; sid:200002031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disneyplusgermany.net",nocase; classtype:attempted-recon; sid:200002032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"displayplanet.pl",nocase; classtype:attempted-recon; sid:200002033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distrial.ec",nocase; classtype:attempted-recon; sid:200002034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"divporides.com",nocase; classtype:attempted-recon; sid:200002035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dizzinesspro.us",nocase; classtype:attempted-recon; sid:200002036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djeliza.be",nocase; classtype:attempted-recon; sid:200002037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djestradation.com",nocase; classtype:attempted-recon; sid:200002038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb-info.com",nocase; classtype:attempted-recon; sid:200002039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb1231ag.site44.com",nocase; classtype:attempted-recon; sid:200002040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkglobaljobs.com",nocase; classtype:attempted-recon; sid:200002041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dl.9xu.com",nocase; classtype:attempted-recon; sid:200002042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlink.me",nocase; classtype:attempted-recon; sid:200002043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlw-iberica.com",nocase; classtype:attempted-recon; sid:200002044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlxdgl.com",nocase; classtype:attempted-recon; sid:200002045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dmarket.name",nocase; classtype:attempted-recon; sid:200002046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dmaxpesca.com.es",nocase; classtype:attempted-recon; sid:200002047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dn1s29yg3m3.typeform.com",nocase; classtype:attempted-recon; sid:200002048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-naphcare.org",nocase; classtype:attempted-recon; sid:200002049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-pasadenaisdshop.com",nocase; classtype:attempted-recon; sid:200002050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc.clickup.com",nocase; classtype:attempted-recon; sid:200002051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc38347343.knorish.com",nocase; classtype:attempted-recon; sid:200002052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doccruser.pvplglobal.com",nocase; classtype:attempted-recon; sid:200002053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doclab-console-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs-verify-c671.thajetiase.workers.dev",nocase; classtype:attempted-recon; sid:200002055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.revv.so",nocase; classtype:attempted-recon; sid:200002056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docshareprivate.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docsharex-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doctoradib.ir",nocase; classtype:attempted-recon; sid:200002059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doctorcomboninos1adb.blogspot.com",nocase; classtype:attempted-recon; sid:200002060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"documents-secure-share-wood-42a4.vesorasa.workers.dev",nocase; classtype:attempted-recon; sid:200002061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docusign-lnc.info",nocase; classtype:attempted-recon; sid:200002062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dodxfjilli.duckdns.org",nocase; classtype:attempted-recon; sid:200002063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dofus-touch.shop",nocase; classtype:attempted-recon; sid:200002064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dofus-touch.store",nocase; classtype:attempted-recon; sid:200002065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doghouserescue.com",nocase; classtype:attempted-recon; sid:200002066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollar-genius.com",nocase; classtype:attempted-recon; sid:200002067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollarbillsquick.com",nocase; classtype:attempted-recon; sid:200002068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domaincheckvalidation76.web.app",nocase; classtype:attempted-recon; sid:200002069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domanub.weebly.com",nocase; classtype:attempted-recon; sid:200002070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dominioits.com",nocase; classtype:attempted-recon; sid:200002071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dommazlxjn.duckdns.org",nocase; classtype:attempted-recon; sid:200002072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domy-serramenti.it",nocase; classtype:attempted-recon; sid:200002073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dongsuh.net",nocase; classtype:attempted-recon; sid:200002074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dopeydog.co.nz",nocase; classtype:attempted-recon; sid:200002075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doqklgisyi.duckdns.org",nocase; classtype:attempted-recon; sid:200002076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dorouscom.com",nocase; classtype:attempted-recon; sid:200002077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dostawaolx.pl",nocase; classtype:attempted-recon; sid:200002078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dotdre.com",nocase; classtype:attempted-recon; sid:200002079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doublechecklogin.rf.gd",nocase; classtype:attempted-recon; sid:200002080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"douuodwoman.com",nocase; classtype:attempted-recon; sid:200002081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dowaba-s2dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200002082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doz.tode.cz",nocase; classtype:attempted-recon; sid:200002083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpasdasfasfasfas.pages.dev",nocase; classtype:attempted-recon; sid:200002084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-billingerror.com",nocase; classtype:attempted-recon; sid:200002085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-oferta.id-info070.me",nocase; classtype:attempted-recon; sid:200002086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-pl.buy-transpay.site",nocase; classtype:attempted-recon; sid:200002087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-redelivery-uk.com",nocase; classtype:attempted-recon; sid:200002088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd.missed3k9j.com",nocase; classtype:attempted-recon; sid:200002089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpfoidspoifopdsifpoi.blogspot.com",nocase; classtype:attempted-recon; sid:200002090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpmasdaskj.pages.dev",nocase; classtype:attempted-recon; sid:200002091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drangelachamorro.com",nocase; classtype:attempted-recon; sid:200002092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drclaudiophd.mfs.gg",nocase; classtype:attempted-recon; sid:200002093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreamlearn.ind.in",nocase; classtype:attempted-recon; sid:200002094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreapp-cheks-account.rf.gd",nocase; classtype:attempted-recon; sid:200002095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"driverschoice.sg",nocase; classtype:attempted-recon; sid:200002096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drivingschoolglasgow.co.uk",nocase; classtype:attempted-recon; sid:200002097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drlalsurgicalhospital.com",nocase; classtype:attempted-recon; sid:200002098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dropingenious.top",nocase; classtype:attempted-recon; sid:200002099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drumairabubakar.com",nocase; classtype:attempted-recon; sid:200002100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drwesleycursos.com",nocase; classtype:attempted-recon; sid:200002101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ds-start.com",nocase; classtype:attempted-recon; sid:200002102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dsgcbeonline.com",nocase; classtype:attempted-recon; sid:200002103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dskedirekt.web.app",nocase; classtype:attempted-recon; sid:200002104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dslogix.io",nocase; classtype:attempted-recon; sid:200002105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dspofipsdoifopsdifposidopfi.blogspot.com",nocase; classtype:attempted-recon; sid:200002106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtiblog.com",nocase; classtype:attempted-recon; sid:200002107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtpprtmwbtudyquwgytcqcthzc-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtrpsystasfasgas.pages.dev",nocase; classtype:attempted-recon; sid:200002109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dublinersalicante.com",nocase; classtype:attempted-recon; sid:200002110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"duffelbagadventures.com",nocase; classtype:attempted-recon; sid:200002111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dukhovnist.in.ua",nocase; classtype:attempted-recon; sid:200002112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dukkanplus.com",nocase; classtype:attempted-recon; sid:200002113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"durablepools.com",nocase; classtype:attempted-recon; sid:200002114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"durecorpperu.com",nocase; classtype:attempted-recon; sid:200002115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dustdearsxx.com",nocase; classtype:attempted-recon; sid:200002116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvdvdv.hyperphp.com",nocase; classtype:attempted-recon; sid:200002117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvla.myvehicle-rebate.com",nocase; classtype:attempted-recon; sid:200002118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvla.support-schemeuk.com",nocase; classtype:attempted-recon; sid:200002119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwdcdcffjhd.square.site",nocase; classtype:attempted-recon; sid:200002120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwrat.andalous.org",nocase; classtype:attempted-recon; sid:200002121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwz.kr",nocase; classtype:attempted-recon; sid:200002122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dxdex.co",nocase; classtype:attempted-recon; sid:200002123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dydex.org",nocase; classtype:attempted-recon; sid:200002124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dydy2.app.link",nocase; classtype:attempted-recon; sid:200002125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyn.co",nocase; classtype:attempted-recon; sid:200002126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dynastyclinic.ae",nocase; classtype:attempted-recon; sid:200002127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyzmaxlfwt.duckdns.org",nocase; classtype:attempted-recon; sid:200002128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dzd.rksmb.org",nocase; classtype:attempted-recon; sid:200002129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-bancapersonal.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-receipts.co",nocase; classtype:attempted-recon; sid:200002131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-registration.co.in",nocase; classtype:attempted-recon; sid:200002132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-voice-msg-844927.webflow.io",nocase; classtype:attempted-recon; sid:200002133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e4ff557e.sso-secure-mail04wtwdw4.pages.dev",nocase; classtype:attempted-recon; sid:200002134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e4ra.byethost8.com",nocase; classtype:attempted-recon; sid:200002135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e68c13fba7717e4a580dce7ecdb2346201c777fe.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eaor.surveysparrow.com",nocase; classtype:attempted-recon; sid:200002137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyholidaytrips.com",nocase; classtype:attempted-recon; sid:200002138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyquotes4you.com",nocase; classtype:attempted-recon; sid:200002139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easytrade.icu",nocase; classtype:attempted-recon; sid:200002140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eba0200d0c.nxcli.net",nocase; classtype:attempted-recon; sid:200002141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebadu.in",nocase; classtype:attempted-recon; sid:200002142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-communaute-fr-t8-forums-de-discussion.22web.org",nocase; classtype:attempted-recon; sid:200002143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-community-de-diskussion-clubs-forum.html-5.me",nocase; classtype:attempted-recon; sid:200002144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-community-de-diskussion-forum.html-5.me",nocase; classtype:attempted-recon; sid:200002145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-de-app.22web.org",nocase; classtype:attempted-recon; sid:200002146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-t1-de.22web.org",nocase; classtype:attempted-recon; sid:200002147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-t2-de.html-5.me",nocase; classtype:attempted-recon; sid:200002148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-forums-de-discussion-fr.22web.org",nocase; classtype:attempted-recon; sid:200002149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay.payment-issues-help.com",nocase; classtype:attempted-recon; sid:200002150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebaystore.shop",nocase; classtype:attempted-recon; sid:200002151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebiz4biz.com.cn",nocase; classtype:attempted-recon; sid:200002152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebuddynews.com",nocase; classtype:attempted-recon; sid:200002153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ec2-18-228-138-208.sa-east-1.compute.amazonaws.com",nocase; classtype:attempted-recon; sid:200002154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eces-ecole.org",nocase; classtype:attempted-recon; sid:200002155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"echostar.pl",nocase; classtype:attempted-recon; sid:200002156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eclipsephotovoltech.com",nocase; classtype:attempted-recon; sid:200002157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eclipsevpn-new.com",nocase; classtype:attempted-recon; sid:200002158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecngx290.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200002159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecngx300.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200002160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; classtype:attempted-recon; sid:200002161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomuseodebicorp.com",nocase; classtype:attempted-recon; sid:200002162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecstatic-germain.62-4-31-175.plesk.page",nocase; classtype:attempted-recon; sid:200002163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edd-ui3.sitey.me",nocase; classtype:attempted-recon; sid:200002164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edgeurl.com",nocase; classtype:attempted-recon; sid:200002165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edhf0c.webwave.dev",nocase; classtype:attempted-recon; sid:200002166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edje.com",nocase; classtype:attempted-recon; sid:200002167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edprconsultants.com",nocase; classtype:attempted-recon; sid:200002168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"educacionplc.com",nocase; classtype:attempted-recon; sid:200002169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"educandoyensenando.com",nocase; classtype:attempted-recon; sid:200002170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"educationsgain.com",nocase; classtype:attempted-recon; sid:200002171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-billing-security.com",nocase; classtype:attempted-recon; sid:200002172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-servicehub.com",nocase; classtype:attempted-recon; sid:200002173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-verify-billing-secure.com",nocase; classtype:attempted-recon; sid:200002174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eezee.pk",nocase; classtype:attempted-recon; sid:200002175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efarms.com.ng",nocase; classtype:attempted-recon; sid:200002176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"effect-print.net",nocase; classtype:attempted-recon; sid:200002177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"effonindia.com",nocase; classtype:attempted-recon; sid:200002178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efjefhfhasfdjajsdajdjs.my-board.org",nocase; classtype:attempted-recon; sid:200002179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efjeuxlwdn.duckdns.org",nocase; classtype:attempted-recon; sid:200002180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eform.en-amin.ir",nocase; classtype:attempted-recon; sid:200002181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egacal.edu.pe",nocase; classtype:attempted-recon; sid:200002182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eggbox.top",nocase; classtype:attempted-recon; sid:200002183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egolijozinews.co.za",nocase; classtype:attempted-recon; sid:200002184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egood.ro",nocase; classtype:attempted-recon; sid:200002185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egypttodaytravel.net",nocase; classtype:attempted-recon; sid:200002186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eh5ko.csb.app",nocase; classtype:attempted-recon; sid:200002187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehan.org",nocase; classtype:attempted-recon; sid:200002188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eharmonyservice.com",nocase; classtype:attempted-recon; sid:200002189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehealthmax.com",nocase; classtype:attempted-recon; sid:200002190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehsan-moonlights.com",nocase; classtype:attempted-recon; sid:200002191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekabel.hu",nocase; classtype:attempted-recon; sid:200002192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekaterinaschol.ru",nocase; classtype:attempted-recon; sid:200002193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekbofexjlnsdsfaqxbcfpnfift-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekobebe.cn",nocase; classtype:attempted-recon; sid:200002195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekvarika.ru",nocase; classtype:attempted-recon; sid:200002196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elchavo8181.byethost8.com",nocase; classtype:attempted-recon; sid:200002197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electrocoolhvacr.com",nocase; classtype:attempted-recon; sid:200002198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electronicanehuen.com",nocase; classtype:attempted-recon; sid:200002199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elegant-haslett.107-173-91-57.plesk.page",nocase; classtype:attempted-recon; sid:200002200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elegode.ma",nocase; classtype:attempted-recon; sid:200002201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektro-live.de",nocase; classtype:attempted-recon; sid:200002202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektroonline.pl",nocase; classtype:attempted-recon; sid:200002203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektrum.top",nocase; classtype:attempted-recon; sid:200002204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200002205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200002206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200002207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200002208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbettgiris4.blogspot.com",nocase; classtype:attempted-recon; sid:200002209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusgirisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200002210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elioraenergy.co.ke",nocase; classtype:attempted-recon; sid:200002211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elite1867.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200002212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ellatinodigital.com",nocase; classtype:attempted-recon; sid:200002213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ellenmedia.club",nocase; classtype:attempted-recon; sid:200002214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elmitabodes.com",nocase; classtype:attempted-recon; sid:200002215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elomo.ro",nocase; classtype:attempted-recon; sid:200002216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elportenio.com",nocase; classtype:attempted-recon; sid:200002217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elshazlyco.com",nocase; classtype:attempted-recon; sid:200002218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eluniversallatinworld.com",nocase; classtype:attempted-recon; sid:200002219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emahajobs.com",nocase; classtype:attempted-recon; sid:200002220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email-vandrunenfarms.com",nocase; classtype:attempted-recon; sid:200002221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.2020cycling.cc",nocase; classtype:attempted-recon; sid:200002222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.alsea.com.mx",nocase; classtype:attempted-recon; sid:200002223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.stickercanada.com",nocase; classtype:attempted-recon; sid:200002224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.touchbasepro.com",nocase; classtype:attempted-recon; sid:200002225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email302.com",nocase; classtype:attempted-recon; sid:200002226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailfilter-update.sitebeat.site",nocase; classtype:attempted-recon; sid:200002227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmarketing.profesionalhosting.com",nocase; classtype:attempted-recon; sid:200002228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailsettings.webflow.io",nocase; classtype:attempted-recon; sid:200002229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emausradio.net",nocase; classtype:attempted-recon; sid:200002230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"embcybersecurity.org",nocase; classtype:attempted-recon; sid:200002231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"embdestech.co.in",nocase; classtype:attempted-recon; sid:200002232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emebfsasampaio.creatorlink.net",nocase; classtype:attempted-recon; sid:200002233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emergencyelectricianfulham.co.uk",nocase; classtype:attempted-recon; sid:200002234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emilianosibada34.byethost4.com",nocase; classtype:attempted-recon; sid:200002235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eminsit.com",nocase; classtype:attempted-recon; sid:200002236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emjel.blogspot.com",nocase; classtype:attempted-recon; sid:200002237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"employee-portal.buildingandearth.com",nocase; classtype:attempted-recon; sid:200002238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas-lnterlbnlk-pe.com",nocase; classtype:attempted-recon; sid:200002239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.lnterbank.1banca.com",nocase; classtype:attempted-recon; sid:200002240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.lnterbank.bacazinternet.com",nocase; classtype:attempted-recon; sid:200002241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.lnterbank.cone-ccion.com",nocase; classtype:attempted-recon; sid:200002242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.netinterbank.interbol-portal.com",nocase; classtype:attempted-recon; sid:200002243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emsi-lobo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"en.akirasushi.com.vn",nocase; classtype:attempted-recon; sid:200002245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enbolivia.com",nocase; classtype:attempted-recon; sid:200002246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"encryptdrive.booogle.net",nocase; classtype:attempted-recon; sid:200002247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"endpointsportal.au-bbva-bancomerappnomina.cloud.goog",nocase; classtype:attempted-recon; sid:200002248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"energygain.co.uk",nocase; classtype:attempted-recon; sid:200002249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"energynsolucoes.com.br",nocase; classtype:attempted-recon; sid:200002250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"engcamp.org",nocase; classtype:attempted-recon; sid:200002251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enlineamovilapp-aperu-digtal.comtechsystemsinc.com",nocase; classtype:attempted-recon; sid:200002252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enorma.is",nocase; classtype:attempted-recon; sid:200002253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enreleboncoin.eu",nocase; classtype:attempted-recon; sid:200002254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enreleboncoin.fr",nocase; classtype:attempted-recon; sid:200002255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ensemblearsmundi.com",nocase; classtype:attempted-recon; sid:200002256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enthusiastic.b1l4b.cn",nocase; classtype:attempted-recon; sid:200002257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enthusiastic.oeuj85qo.cn",nocase; classtype:attempted-recon; sid:200002258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enviosc-cl.blogspot.com",nocase; classtype:attempted-recon; sid:200002259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enviromentaldrone.com",nocase; classtype:attempted-recon; sid:200002260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eo.is",nocase; classtype:attempted-recon; sid:200002261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epccs.ceaerod.com",nocase; classtype:attempted-recon; sid:200002262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epcos.ceaerod.com",nocase; classtype:attempted-recon; sid:200002263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epersonsalvagricolog.freecluster.eu",nocase; classtype:attempted-recon; sid:200002264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epiciek.com",nocase; classtype:attempted-recon; sid:200002265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eproxy.pusan.ac.kr",nocase; classtype:attempted-recon; sid:200002266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epsuc.ceaerod.com",nocase; classtype:attempted-recon; sid:200002267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eqfugtsgss.duckdns.org",nocase; classtype:attempted-recon; sid:200002268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"equalchances.org",nocase; classtype:attempted-recon; sid:200002269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eraeiar.cc",nocase; classtype:attempted-recon; sid:200002270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erastylogestle039.clickfunnels.com",nocase; classtype:attempted-recon; sid:200002271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erciudolne.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ergfg.hyperphp.com",nocase; classtype:attempted-recon; sid:200002273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erp.oriontravels.com.bd",nocase; classtype:attempted-recon; sid:200002274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ertlh.denpasarkota.go.id",nocase; classtype:attempted-recon; sid:200002275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"es32px.cn",nocase; classtype:attempted-recon; sid:200002276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esatunggalpratama.com",nocase; classtype:attempted-recon; sid:200002277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eschoolzones.com",nocase; classtype:attempted-recon; sid:200002278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"escortinraipur.com",nocase; classtype:attempted-recon; sid:200002279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esgcommercialbrokers.com",nocase; classtype:attempted-recon; sid:200002280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esinnovativeinteriors.com",nocase; classtype:attempted-recon; sid:200002281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"essence.co.th",nocase; classtype:attempted-recon; sid:200002282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"establecimientoscolonia-uy.com",nocase; classtype:attempted-recon; sid:200002283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estetika2z.com",nocase; classtype:attempted-recon; sid:200002284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estorneaqui.blogspot.com",nocase; classtype:attempted-recon; sid:200002285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estuary.zorinn.com",nocase; classtype:attempted-recon; sid:200002286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estudiomaskin.com",nocase; classtype:attempted-recon; sid:200002287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etasarla.com",nocase; classtype:attempted-recon; sid:200002288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai-jp.huazongkeji.cn",nocase; classtype:attempted-recon; sid:200002289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.2k31g03.cn",nocase; classtype:attempted-recon; sid:200002290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.8b062c.cn",nocase; classtype:attempted-recon; sid:200002291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.a5hz8z.cn",nocase; classtype:attempted-recon; sid:200002292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.abaiwomen.cn",nocase; classtype:attempted-recon; sid:200002293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.idcvm.cn",nocase; classtype:attempted-recon; sid:200002294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.iewzehc.cn",nocase; classtype:attempted-recon; sid:200002295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.urlut.cn",nocase; classtype:attempted-recon; sid:200002296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.usryvi.cn",nocase; classtype:attempted-recon; sid:200002297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.wfjpe.cn",nocase; classtype:attempted-recon; sid:200002298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.k5878.cn",nocase; classtype:attempted-recon; sid:200002299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.lbesd9.cn",nocase; classtype:attempted-recon; sid:200002300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.pdcso.cn",nocase; classtype:attempted-recon; sid:200002301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.xvk06m7.cn",nocase; classtype:attempted-recon; sid:200002302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.zi7vr7.cn",nocase; classtype:attempted-recon; sid:200002303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisaide.myddns.me",nocase; classtype:attempted-recon; sid:200002304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-merisai.szfzc.cn",nocase; classtype:attempted-recon; sid:200002305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc.marcuskeil.com",nocase; classtype:attempted-recon; sid:200002306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc.meisa1.jp.zunxiao.club",nocase; classtype:attempted-recon; sid:200002307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etcjapan-rebert.cf",nocase; classtype:attempted-recon; sid:200002308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eth.coinscout.cc",nocase; classtype:attempted-recon; sid:200002309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ethelpay.com",nocase; classtype:attempted-recon; sid:200002310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ethereum.tel",nocase; classtype:attempted-recon; sid:200002311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ethnictrendz.com",nocase; classtype:attempted-recon; sid:200002312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etisalat-ae-emirates.com",nocase; classtype:attempted-recon; sid:200002313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etrack05.com",nocase; classtype:attempted-recon; sid:200002314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eu.nuvuneu.com",nocase; classtype:attempted-recon; sid:200002315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eufgw.glaucidi.workers.dev",nocase; classtype:attempted-recon; sid:200002316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"euqncmyczydmhgbnwkexpvfurzettj.66ghz.com",nocase; classtype:attempted-recon; sid:200002318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"euroautomentes.hu",nocase; classtype:attempted-recon; sid:200002319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eurotecusa.com",nocase; classtype:attempted-recon; sid:200002320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eusa-lombo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eva.cenoa.com.ar",nocase; classtype:attempted-recon; sid:200002322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evashoes.com.ua",nocase; classtype:attempted-recon; sid:200002323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eve292929.dothome.co.kr",nocase; classtype:attempted-recon; sid:200002324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"event-hadiah-gratis-2021.duckdns.org",nocase; classtype:attempted-recon; sid:200002325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"event-terbaru-freefire-old785.duckdns.org",nocase; classtype:attempted-recon; sid:200002326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventdmfrefire-gratis.duckdns.org",nocase; classtype:attempted-recon; sid:200002327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everestmotors.com.np",nocase; classtype:attempted-recon; sid:200002328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evershineuae.net",nocase; classtype:attempted-recon; sid:200002329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evotechss.com",nocase; classtype:attempted-recon; sid:200002330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evwww-metam.top",nocase; classtype:attempted-recon; sid:200002331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ewallet.pk",nocase; classtype:attempted-recon; sid:200002332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ewb.fi",nocase; classtype:attempted-recon; sid:200002333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"examinacion78.byethost31.com",nocase; classtype:attempted-recon; sid:200002334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excel-cloud-document-2021.square.site",nocase; classtype:attempted-recon; sid:200002335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exceloffice.ru",nocase; classtype:attempted-recon; sid:200002336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchange4free.com",nocase; classtype:attempted-recon; sid:200002337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchangedictionary.com",nocase; classtype:attempted-recon; sid:200002338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchangep2pera.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exclusive20-20.byethost15.com",nocase; classtype:attempted-recon; sid:200002340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excodous.online",nocase; classtype:attempted-recon; sid:200002341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exctodos.com",nocase; classtype:attempted-recon; sid:200002342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exobus.net",nocase; classtype:attempted-recon; sid:200002343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoclus.com",nocase; classtype:attempted-recon; sid:200002344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-airdrop.com",nocase; classtype:attempted-recon; sid:200002345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-staking.web.app",nocase; classtype:attempted-recon; sid:200002346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusc.com",nocase; classtype:attempted-recon; sid:200002347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusl.com",nocase; classtype:attempted-recon; sid:200002348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduspool.io",nocase; classtype:attempted-recon; sid:200002349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodususa.net",nocase; classtype:attempted-recon; sid:200002350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduswalet.com",nocase; classtype:attempted-recon; sid:200002351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduswl.com",nocase; classtype:attempted-recon; sid:200002352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoodus-wallet.yahoosites.com",nocase; classtype:attempted-recon; sid:200002353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exosdus.online",nocase; classtype:attempted-recon; sid:200002354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exosomes.sale",nocase; classtype:attempted-recon; sid:200002355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoticautowa.com",nocase; classtype:attempted-recon; sid:200002356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expeditions-of-e.com",nocase; classtype:attempted-recon; sid:200002357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expire-o2-billingupdate.com",nocase; classtype:attempted-recon; sid:200002358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exploratravels.com",nocase; classtype:attempted-recon; sid:200002359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exploretrace.xyz",nocase; classtype:attempted-recon; sid:200002360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extension-metamask.com.rstebet.co.id",nocase; classtype:attempted-recon; sid:200002361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extension.asue.am",nocase; classtype:attempted-recon; sid:200002362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracash-interlbankonline.com",nocase; classtype:attempted-recon; sid:200002363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracloud.com.au",nocase; classtype:attempted-recon; sid:200002364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extractance.com",nocase; classtype:attempted-recon; sid:200002365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extravasatingmetalworker.com",nocase; classtype:attempted-recon; sid:200002366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extrcshsorteos.com",nocase; classtype:attempted-recon; sid:200002367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ey8jl.csb.app",nocase; classtype:attempted-recon; sid:200002368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eye-lucir.com",nocase; classtype:attempted-recon; sid:200002369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezapostille.com",nocase; classtype:attempted-recon; sid:200002370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezblox.site",nocase; classtype:attempted-recon; sid:200002371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezh.ags.mybluehost.me",nocase; classtype:attempted-recon; sid:200002372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezssausage.com",nocase; classtype:attempted-recon; sid:200002373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f.ls",nocase; classtype:attempted-recon; sid:200002374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f1fa-tms-org.xyz",nocase; classtype:attempted-recon; sid:200002375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f4i3q0.cn",nocase; classtype:attempted-recon; sid:200002376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f6fr7.codesandbox.io",nocase; classtype:attempted-recon; sid:200002377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com",nocase; classtype:attempted-recon; sid:200002378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fabrikamp.com",nocase; classtype:attempted-recon; sid:200002379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facabook.in",nocase; classtype:attempted-recon; sid:200002380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faccebook.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faceboock.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-accts.pages-recovery.workers.dev",nocase; classtype:attempted-recon; sid:200002383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-login.tbit.vn",nocase; classtype:attempted-recon; sid:200002384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-setelan.ntdll.top",nocase; classtype:attempted-recon; sid:200002385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-marketplace-93839.mediaryte.co",nocase; classtype:attempted-recon; sid:200002386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.eventspinff.wtf",nocase; classtype:attempted-recon; sid:200002387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.hrbureaugh.com",nocase; classtype:attempted-recon; sid:200002388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebookk.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebooklogi.com",nocase; classtype:attempted-recon; sid:200002390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebooks.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facelessinseattle.com",nocase; classtype:attempted-recon; sid:200002392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"factoryouttletgrgr.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facturard.com",nocase; classtype:attempted-recon; sid:200002394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faithcitychapel.org",nocase; classtype:attempted-recon; sid:200002395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faizankhan0408.github.io",nocase; classtype:attempted-recon; sid:200002396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faktypolska7.b-cdn.net",nocase; classtype:attempted-recon; sid:200002397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faleupas.kissr.com",nocase; classtype:attempted-recon; sid:200002398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fancycricket11.com",nocase; classtype:attempted-recon; sid:200002399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fanxtv.info",nocase; classtype:attempted-recon; sid:200002400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"farmac.com.mx",nocase; classtype:attempted-recon; sid:200002401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"farmaclub.com.ec",nocase; classtype:attempted-recon; sid:200002402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fashionphotographycourse.com",nocase; classtype:attempted-recon; sid:200002403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faster-seafood-musicians-transfers.trycloudflare.com",nocase; classtype:attempted-recon; sid:200002404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fasthost.hk",nocase; classtype:attempted-recon; sid:200002405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastskins.ru.com",nocase; classtype:attempted-recon; sid:200002406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-digitalhiiper.net",nocase; classtype:attempted-recon; sid:200002407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-hiiiper-digital.net",nocase; classtype:attempted-recon; sid:200002408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faturadigiital-hiper.net",nocase; classtype:attempted-recon; sid:200002409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fax.gruppobiesse.it",nocase; classtype:attempted-recon; sid:200002410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faxitalia.com",nocase; classtype:attempted-recon; sid:200002411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-blockapp.duckdns.org",nocase; classtype:attempted-recon; sid:200002412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-marketplace8245.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.expressturkeyi.com",nocase; classtype:attempted-recon; sid:200002414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.probox.lk",nocase; classtype:attempted-recon; sid:200002415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb7927.bget.ru",nocase; classtype:attempted-recon; sid:200002416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbforpages1414141.web.app",nocase; classtype:attempted-recon; sid:200002417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fc.proyectosonline.xyz",nocase; classtype:attempted-recon; sid:200002418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fdgnxiwlaaook.com",nocase; classtype:attempted-recon; sid:200002419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fdmkglfdmlkgmf45.top",nocase; classtype:attempted-recon; sid:200002420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fdx.co.th",nocase; classtype:attempted-recon; sid:200002421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feceboolk.blogspot.com",nocase; classtype:attempted-recon; sid:200002422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"federalaccesscredit.com",nocase; classtype:attempted-recon; sid:200002423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedexvoyager.com",nocase; classtype:attempted-recon; sid:200002424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedlxpress.com",nocase; classtype:attempted-recon; sid:200002425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedner.net",nocase; classtype:attempted-recon; sid:200002426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedilicious.com",nocase; classtype:attempted-recon; sid:200002427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"felcon.com.ve",nocase; classtype:attempted-recon; sid:200002428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"felhawq.bookofblue.eu",nocase; classtype:attempted-recon; sid:200002429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"felipecostta94.github.io",nocase; classtype:attempted-recon; sid:200002430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fene-modi.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ferienhof-gempel.de",nocase; classtype:attempted-recon; sid:200002432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fertinose.rocks",nocase; classtype:attempted-recon; sid:200002433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ffcs.com.pk",nocase; classtype:attempted-recon; sid:200002434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fghjkllkjvcvjkl.square.site",nocase; classtype:attempted-recon; sid:200002435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fghjr74rhudfguhtfguji.blogspot.com",nocase; classtype:attempted-recon; sid:200002436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgts2021.com",nocase; classtype:attempted-recon; sid:200002437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgwedf.peradi7014.workers.dev",nocase; classtype:attempted-recon; sid:200002438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhhw1u.webwave.dev",nocase; classtype:attempted-recon; sid:200002439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhjrt.com",nocase; classtype:attempted-recon; sid:200002440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fianceflowers.ir",nocase; classtype:attempted-recon; sid:200002441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fibncrpvgwzrghkvpduzyanidnyfvcwwaqndtidtjeduu.66ghz.com",nocase; classtype:attempted-recon; sid:200002442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fid-2login.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200002443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiestanube.com.ar",nocase; classtype:attempted-recon; sid:200002444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; classtype:attempted-recon; sid:200002445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fileundelete.net",nocase; classtype:attempted-recon; sid:200002446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filialtransaccionalcolombiacol.com",nocase; classtype:attempted-recon; sid:200002447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filsafat.stahnmpukuturan.ac.id",nocase; classtype:attempted-recon; sid:200002448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filtrosmil.com.br",nocase; classtype:attempted-recon; sid:200002449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fin-portal-spar-kasse.com",nocase; classtype:attempted-recon; sid:200002450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financiallifecoaching.builderallwp.com",nocase; classtype:attempted-recon; sid:200002451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financialone.com.hk",nocase; classtype:attempted-recon; sid:200002452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financialvisionandservices.com",nocase; classtype:attempted-recon; sid:200002453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financieracredicorpltda.com",nocase; classtype:attempted-recon; sid:200002454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finanzid-portal-verifizierer.com",nocase; classtype:attempted-recon; sid:200002455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findrealtors.tv",nocase; classtype:attempted-recon; sid:200002456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findurway.tech",nocase; classtype:attempted-recon; sid:200002457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finportal-spk-home.com",nocase; classtype:attempted-recon; sid:200002458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finportal-spk.com",nocase; classtype:attempted-recon; sid:200002459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fir8958758455.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstcallautomation.in",nocase; classtype:attempted-recon; sid:200002461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstladyofcountry.com",nocase; classtype:attempted-recon; sid:200002462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstobmen.live",nocase; classtype:attempted-recon; sid:200002463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fish.tw1.su",nocase; classtype:attempted-recon; sid:200002464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fisika.fmipa.unila.ac.id",nocase; classtype:attempted-recon; sid:200002465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fitenergy.com.ec",nocase; classtype:attempted-recon; sid:200002466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiteram.eliotek.net",nocase; classtype:attempted-recon; sid:200002467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fitgasmic.com",nocase; classtype:attempted-recon; sid:200002468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiuf89ufgigigi.yolasite.com",nocase; classtype:attempted-recon; sid:200002469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixertawa.blogspot.com",nocase; classtype:attempted-recon; sid:200002470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixi.rest",nocase; classtype:attempted-recon; sid:200002471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fizikagroup.ru",nocase; classtype:attempted-recon; sid:200002472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flamecool.in",nocase; classtype:attempted-recon; sid:200002473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flixpassed.com",nocase; classtype:attempted-recon; sid:200002474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flladv.com.br",nocase; classtype:attempted-recon; sid:200002475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"floorsdirectltd.co.uk",nocase; classtype:attempted-recon; sid:200002476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flouchs112.freecluster.eu",nocase; classtype:attempted-recon; sid:200002477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowtork.com",nocase; classtype:attempted-recon; sid:200002478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fluksrv.mycpanel.rs",nocase; classtype:attempted-recon; sid:200002479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fm.registrobarretos.com.br",nocase; classtype:attempted-recon; sid:200002480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fmail.youxianghs.work",nocase; classtype:attempted-recon; sid:200002481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fmpos.ucad.sn",nocase; classtype:attempted-recon; sid:200002482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foamnflow.com",nocase; classtype:attempted-recon; sid:200002483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"focar.vn",nocase; classtype:attempted-recon; sid:200002484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foliar.pl",nocase; classtype:attempted-recon; sid:200002485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"folignocrediti.it",nocase; classtype:attempted-recon; sid:200002486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foma-ura-lote.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foorwhatepouse.byethost9.com",nocase; classtype:attempted-recon; sid:200002488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"football-station.net",nocase; classtype:attempted-recon; sid:200002489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fordlscrunch.com",nocase; classtype:attempted-recon; sid:200002490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foresta-mod.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forexdini.com",nocase; classtype:attempted-recon; sid:200002492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forfoodies.co",nocase; classtype:attempted-recon; sid:200002493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formbuddy.com",nocase; classtype:attempted-recon; sid:200002494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.formium.io",nocase; classtype:attempted-recon; sid:200002495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formtools.com",nocase; classtype:attempted-recon; sid:200002496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formula.servepics.com",nocase; classtype:attempted-recon; sid:200002497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forumasik.com",nocase; classtype:attempted-recon; sid:200002498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forumgalixia.byethost6.com",nocase; classtype:attempted-recon; sid:200002499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forums.rstools.club",nocase; classtype:attempted-recon; sid:200002500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forwardfunctionalfitness.com",nocase; classtype:attempted-recon; sid:200002501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fosnetsecuritycameras.com",nocase; classtype:attempted-recon; sid:200002502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foulath.com.de",nocase; classtype:attempted-recon; sid:200002503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"found-orlen.us",nocase; classtype:attempted-recon; sid:200002504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foxdancecompany.com",nocase; classtype:attempted-recon; sid:200002505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fpcommunitystandardabuse.co.vu",nocase; classtype:attempted-recon; sid:200002506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fpmaam.org",nocase; classtype:attempted-recon; sid:200002507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fpuritypaf.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fq2wsad.lapar83986.workers.dev",nocase; classtype:attempted-recon; sid:200002509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fr-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fraenkly-speaking.de",nocase; classtype:attempted-recon; sid:200002511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fralindendre.com",nocase; classtype:attempted-recon; sid:200002512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"framecapturestudio.com",nocase; classtype:attempted-recon; sid:200002513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"france-delicatessen.com",nocase; classtype:attempted-recon; sid:200002514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-my-cheetah-website-copy.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-oro.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-ro.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frankfurtertsparkasse.web.app",nocase; classtype:attempted-recon; sid:200002518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frankqvo.surveysparrow.com",nocase; classtype:attempted-recon; sid:200002519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freddsur111.byethost32.com",nocase; classtype:attempted-recon; sid:200002520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-bkprealnew83.duckdns.org",nocase; classtype:attempted-recon; sid:200002521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-firecoderedem.blogspot.com",nocase; classtype:attempted-recon; sid:200002522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeboomin.com",nocase; classtype:attempted-recon; sid:200002523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freegsm.co",nocase; classtype:attempted-recon; sid:200002524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeliker.net",nocase; classtype:attempted-recon; sid:200002525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeproductkey.org",nocase; classtype:attempted-recon; sid:200002526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freepubgs.live",nocase; classtype:attempted-recon; sid:200002527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeride-gulmarg.com",nocase; classtype:attempted-recon; sid:200002528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frerfire-gaming.mrbonus.com",nocase; classtype:attempted-recon; sid:200002529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fresher.hicam.net",nocase; classtype:attempted-recon; sid:200002530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"friendsofnechockey.com",nocase; classtype:attempted-recon; sid:200002531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frifo-itaupy.eb2a.com",nocase; classtype:attempted-recon; sid:200002532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frizzter.freecluster.eu",nocase; classtype:attempted-recon; sid:200002533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fromamazon.ingamazonstart.work",nocase; classtype:attempted-recon; sid:200002534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fromthenotice.ingamazoncardstart.top",nocase; classtype:attempted-recon; sid:200002535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frosty-neumann-9eefbc.netlify.app",nocase; classtype:attempted-recon; sid:200002536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fruernes.dk",nocase; classtype:attempted-recon; sid:200002537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fruit-valley.nl",nocase; classtype:attempted-recon; sid:200002538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftp.lesterandco.com",nocase; classtype:attempted-recon; sid:200002539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftp.trialshop.it",nocase; classtype:attempted-recon; sid:200002540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftvcskfamphp.square.site",nocase; classtype:attempted-recon; sid:200002541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-ca.com",nocase; classtype:attempted-recon; sid:200002542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-exchangex.com",nocase; classtype:attempted-recon; sid:200002543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-le.com",nocase; classtype:attempted-recon; sid:200002544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-lp.com",nocase; classtype:attempted-recon; sid:200002545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-me.com",nocase; classtype:attempted-recon; sid:200002546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register-pro.world",nocase; classtype:attempted-recon; sid:200002547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.biz",nocase; classtype:attempted-recon; sid:200002548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.top",nocase; classtype:attempted-recon; sid:200002549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.website",nocase; classtype:attempted-recon; sid:200002550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-registter.com",nocase; classtype:attempted-recon; sid:200002551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-signup.click",nocase; classtype:attempted-recon; sid:200002552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx.cool",nocase; classtype:attempted-recon; sid:200002553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx.idwebsite.me",nocase; classtype:attempted-recon; sid:200002554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuad.iainkendari.ac.id",nocase; classtype:attempted-recon; sid:200002555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuer-sie-sind-wir-immer-da-x.xyz",nocase; classtype:attempted-recon; sid:200002556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuer-sie-sind-wir-immer-da-y.xyz",nocase; classtype:attempted-recon; sid:200002557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuer-sie-sind-wir-immer-da.xyz",nocase; classtype:attempted-recon; sid:200002558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"funiswap.exchange",nocase; classtype:attempted-recon; sid:200002559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"futhorkhonlamsf.com",nocase; classtype:attempted-recon; sid:200002560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"futuretroveschool.com",nocase; classtype:attempted-recon; sid:200002561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fwq.widet69219.workers.dev",nocase; classtype:attempted-recon; sid:200002562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxhalifax.com",nocase; classtype:attempted-recon; sid:200002563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxt27.csb.app",nocase; classtype:attempted-recon; sid:200002564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxxmpavktyihgyqitmuaimubui-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fzbfhn.webwave.dev",nocase; classtype:attempted-recon; sid:200002566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g-mtcc.com",nocase; classtype:attempted-recon; sid:200002567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g1lib.skipdns.link",nocase; classtype:attempted-recon; sid:200002568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g5-citi.com",nocase; classtype:attempted-recon; sid:200002569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ga.teesmith.shop",nocase; classtype:attempted-recon; sid:200002570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gabung-grub-v18.duckdns.org",nocase; classtype:attempted-recon; sid:200002571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gabungg-gruppwhattsapp18.ftp1.biz",nocase; classtype:attempted-recon; sid:200002572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gabunggrupwhatsapbokep.duckdns.org",nocase; classtype:attempted-recon; sid:200002573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gakrvwufrvhxjaabezdbltlhff-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galcbheoo9.byethost33.com",nocase; classtype:attempted-recon; sid:200002575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galiciabankimg.ihostfull.com",nocase; classtype:attempted-recon; sid:200002576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galiciaspersonal.eshost.com.ar",nocase; classtype:attempted-recon; sid:200002577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gameofbet.info",nocase; classtype:attempted-recon; sid:200002578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gameofbet.org",nocase; classtype:attempted-recon; sid:200002579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gamestoppc.com",nocase; classtype:attempted-recon; sid:200002580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garage.imergecrm.in",nocase; classtype:attempted-recon; sid:200002581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gardeniahotel.in",nocase; classtype:attempted-recon; sid:200002582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garena-xacminhtaikhoan.com",nocase; classtype:attempted-recon; sid:200002583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gasterdeckbuilde.com",nocase; classtype:attempted-recon; sid:200002584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gator3030.temp.domains",nocase; classtype:attempted-recon; sid:200002585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gator4203.temp.domains",nocase; classtype:attempted-recon; sid:200002586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gawvs.in",nocase; classtype:attempted-recon; sid:200002587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gazirafsan.com",nocase; classtype:attempted-recon; sid:200002588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gazobetonaero.live",nocase; classtype:attempted-recon; sid:200002589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gbincoin.com",nocase; classtype:attempted-recon; sid:200002590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gchronics.com",nocase; classtype:attempted-recon; sid:200002591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ge-ge.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200002592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gebox.es",nocase; classtype:attempted-recon; sid:200002593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gedonlef.com",nocase; classtype:attempted-recon; sid:200002594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"geg.li",nocase; classtype:attempted-recon; sid:200002595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"geneo-distributors.ynadev.com",nocase; classtype:attempted-recon; sid:200002596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generarba232.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generarcita-sv.com",nocase; classtype:attempted-recon; sid:200002598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generatepass9.web.app",nocase; classtype:attempted-recon; sid:200002599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generationalkidz.com",nocase; classtype:attempted-recon; sid:200002600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"genie-alba.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"genietech.sg",nocase; classtype:attempted-recon; sid:200002602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gentelisst20.byethost33.com",nocase; classtype:attempted-recon; sid:200002603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"georgegreg658.cabanova.com",nocase; classtype:attempted-recon; sid:200002604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"georgklou39hi.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"germackpistachio.com",nocase; classtype:attempted-recon; sid:200002606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gestacultura.com",nocase; classtype:attempted-recon; sid:200002607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getactive365.com",nocase; classtype:attempted-recon; sid:200002608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getapps.vip",nocase; classtype:attempted-recon; sid:200002609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getfunding.pledesma.com",nocase; classtype:attempted-recon; sid:200002610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getitapprovedacceptourterms2021.pages.dev",nocase; classtype:attempted-recon; sid:200002611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getlikesfree.com",nocase; classtype:attempted-recon; sid:200002612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getmystimulus.org",nocase; classtype:attempted-recon; sid:200002613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getrealreview.com",nocase; classtype:attempted-recon; sid:200002614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfprcjvijumkuxtkftvpgdawkqrxrz.22web.org",nocase; classtype:attempted-recon; sid:200002615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfxx.creatorlink.net",nocase; classtype:attempted-recon; sid:200002616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ggivrrterxnndbcunfchzyeirxdcnv.22web.org",nocase; classtype:attempted-recon; sid:200002617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghislain.dartois.pagesperso-orange.fr",nocase; classtype:attempted-recon; sid:200002618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghoostheplain.byethost7.com",nocase; classtype:attempted-recon; sid:200002619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghorana.com",nocase; classtype:attempted-recon; sid:200002620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giftcards.allomoncoco.com",nocase; classtype:attempted-recon; sid:200002621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giris-papara.net",nocase; classtype:attempted-recon; sid:200002622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girlsgroupwhtsapponlysexxy.xxuz.com",nocase; classtype:attempted-recon; sid:200002623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girofilialinfo-spk.com",nocase; classtype:attempted-recon; sid:200002624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girohome-spk.com",nocase; classtype:attempted-recon; sid:200002625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giroid-service-spk.com",nocase; classtype:attempted-recon; sid:200002626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girokontencheckerobportalchecker.com",nocase; classtype:attempted-recon; sid:200002627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gite-lafage.com",nocase; classtype:attempted-recon; sid:200002628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gjhanekamp.nl",nocase; classtype:attempted-recon; sid:200002629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gkjx168.com",nocase; classtype:attempted-recon; sid:200002630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glamournailsbyleda.com",nocase; classtype:attempted-recon; sid:200002632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globailpage-prodwebex.com",nocase; classtype:attempted-recon; sid:200002633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalautodoor.com",nocase; classtype:attempted-recon; sid:200002634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalniche.net",nocase; classtype:attempted-recon; sid:200002635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalpage-prodwebex.com",nocase; classtype:attempted-recon; sid:200002636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glogo.org",nocase; classtype:attempted-recon; sid:200002637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glomediamarketinginstitute.com",nocase; classtype:attempted-recon; sid:200002638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glossmeup.ae",nocase; classtype:attempted-recon; sid:200002639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gls-pakke-dk.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glsword.com",nocase; classtype:attempted-recon; sid:200002641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gm-xaktualisierungmail.yolasite.com",nocase; classtype:attempted-recon; sid:200002642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmail-phone-support.com",nocase; classtype:attempted-recon; sid:200002643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmall-involceview-verilog-auth.pages.dev",nocase; classtype:attempted-recon; sid:200002644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-aktualisieren.yolasite.com",nocase; classtype:attempted-recon; sid:200002645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-aktualisierung.yolasite.com",nocase; classtype:attempted-recon; sid:200002646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-mail-net.yolasite.com",nocase; classtype:attempted-recon; sid:200002647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxaktualisierungmail.yolasite.com",nocase; classtype:attempted-recon; sid:200002648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxchrismyfderna.yolasite.com",nocase; classtype:attempted-recon; sid:200002649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxmailme.yolasite.com",nocase; classtype:attempted-recon; sid:200002650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go-analytics.paineldemonstrativo.com.br",nocase; classtype:attempted-recon; sid:200002651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.simplify.co.nz",nocase; classtype:attempted-recon; sid:200002652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go24link.com",nocase; classtype:attempted-recon; sid:200002653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gofreegovernmentmoney.com",nocase; classtype:attempted-recon; sid:200002654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goglemaps.co",nocase; classtype:attempted-recon; sid:200002655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldcoastrhinoplasty.com.au",nocase; classtype:attempted-recon; sid:200002656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldenlasgidi10.web.app",nocase; classtype:attempted-recon; sid:200002657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golfballsonline.com",nocase; classtype:attempted-recon; sid:200002658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golfpulse.net",nocase; classtype:attempted-recon; sid:200002659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golkondaresorts.com",nocase; classtype:attempted-recon; sid:200002660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gologinwang.cf",nocase; classtype:attempted-recon; sid:200002661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"good12345.tripod.com",nocase; classtype:attempted-recon; sid:200002662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goodfhrwsebngljseori.xyz",nocase; classtype:attempted-recon; sid:200002663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goodiegirlscupcakes.com",nocase; classtype:attempted-recon; sid:200002664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goodstransporter.com",nocase; classtype:attempted-recon; sid:200002665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goofy-keldysh.107-174-50-164.plesk.page",nocase; classtype:attempted-recon; sid:200002666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google-quality-rater-audit.com",nocase; classtype:attempted-recon; sid:200002667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.accoumts.ga",nocase; classtype:attempted-recon; sid:200002668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.storagepolicy.com",nocase; classtype:attempted-recon; sid:200002669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gordonhannan.com",nocase; classtype:attempted-recon; sid:200002670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorgeousgetaways.com",nocase; classtype:attempted-recon; sid:200002671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorin-monoffre.fr",nocase; classtype:attempted-recon; sid:200002672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gornjimilanovac.rs",nocase; classtype:attempted-recon; sid:200002673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosafes.com",nocase; classtype:attempted-recon; sid:200002674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosalair.com",nocase; classtype:attempted-recon; sid:200002675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goshenmontessorischools.com",nocase; classtype:attempted-recon; sid:200002676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gotholdng.com",nocase; classtype:attempted-recon; sid:200002677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gourmetadomicilio.es",nocase; classtype:attempted-recon; sid:200002678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gourtt-manta2-ec.hostkda.com",nocase; classtype:attempted-recon; sid:200002679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gov.jaggreysfertility.com",nocase; classtype:attempted-recon; sid:200002680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gov.uk-dvla.org",nocase; classtype:attempted-recon; sid:200002681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"govcig.co",nocase; classtype:attempted-recon; sid:200002682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"governance-secure2.redirectme.net",nocase; classtype:attempted-recon; sid:200002683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"govkn.knorish.com",nocase; classtype:attempted-recon; sid:200002684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gpbom.codesandbox.io",nocase; classtype:attempted-recon; sid:200002685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gpwsmlyuvirllbkeep18.wikaba.com",nocase; classtype:attempted-recon; sid:200002686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grab.zenstream.com",nocase; classtype:attempted-recon; sid:200002687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grabyourcode.com",nocase; classtype:attempted-recon; sid:200002688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandbettinggir2.blogspot.com",nocase; classtype:attempted-recon; sid:200002689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandmarketltd.co.uk",nocase; classtype:attempted-recon; sid:200002690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greaterlovefoundation.org",nocase; classtype:attempted-recon; sid:200002691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greatmusica.com",nocase; classtype:attempted-recon; sid:200002692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greensvilleheritagemoney.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gregmounsey.com",nocase; classtype:attempted-recon; sid:200002694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grepstatic03-raukantdat.com",nocase; classtype:attempted-recon; sid:200002695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gripseld.com",nocase; classtype:attempted-recon; sid:200002696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grosshandel-mevida.de",nocase; classtype:attempted-recon; sid:200002697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grottedisaledesenzano.com",nocase; classtype:attempted-recon; sid:200002698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groundlevelapps.com",nocase; classtype:attempted-recon; sid:200002699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"group-18-sans.wikaba.com",nocase; classtype:attempted-recon; sid:200002700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"group-orlen.us",nocase; classtype:attempted-recon; sid:200002701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grouporlen.biz",nocase; classtype:attempted-recon; sid:200002702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grouporlen.us",nocase; classtype:attempted-recon; sid:200002703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groupwhattsap.jkub.com",nocase; classtype:attempted-recon; sid:200002704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"growasiacapital.id",nocase; classtype:attempted-recon; sid:200002705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groworldinternational.com",nocase; classtype:attempted-recon; sid:200002706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubbokep22.mrbonus.com",nocase; classtype:attempted-recon; sid:200002707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubtante-vvip1.forumz.info",nocase; classtype:attempted-recon; sid:200002708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubtantekienzy.forumz.info",nocase; classtype:attempted-recon; sid:200002709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubwhatsaap-kienzy.duckdns.org",nocase; classtype:attempted-recon; sid:200002710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubwhatsaap-kienzyviral.duckdns.org",nocase; classtype:attempted-recon; sid:200002711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubwhatshapkienzy-21.duckdns.org",nocase; classtype:attempted-recon; sid:200002712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-wa-bokep18.wikaba.com",nocase; classtype:attempted-recon; sid:200002713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-whatsappsexy.xxuz.com",nocase; classtype:attempted-recon; sid:200002714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupdewasa-178.duckdns.org",nocase; classtype:attempted-recon; sid:200002715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupdewasanobocil.duckdns.org",nocase; classtype:attempted-recon; sid:200002716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupoabi.cl",nocase; classtype:attempted-recon; sid:200002717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupofsp.com.br",nocase; classtype:attempted-recon; sid:200002718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupopromeric.webcindario.com",nocase; classtype:attempted-recon; sid:200002719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruposcherman.com.br",nocase; classtype:attempted-recon; sid:200002720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupp18vral-vhk.duckdns.org",nocase; classtype:attempted-recon; sid:200002721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruppwhatsap18.duckdns.org",nocase; classtype:attempted-recon; sid:200002722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwa-virall99.duckdns.org",nocase; classtype:attempted-recon; sid:200002723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwa18-tys.wikaba.com",nocase; classtype:attempted-recon; sid:200002724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwhasapdewasa.duckdns.org",nocase; classtype:attempted-recon; sid:200002725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwhasapinvite.forumz.info",nocase; classtype:attempted-recon; sid:200002726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gscif.org",nocase; classtype:attempted-recon; sid:200002727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gscommunityspirit.greenschool.org",nocase; classtype:attempted-recon; sid:200002728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gtaswansea.org",nocase; classtype:attempted-recon; sid:200002729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gtb2bexim.com",nocase; classtype:attempted-recon; sid:200002730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guainco.com",nocase; classtype:attempted-recon; sid:200002731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guardofferte.com",nocase; classtype:attempted-recon; sid:200002732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gudanggamismuslimah.com",nocase; classtype:attempted-recon; sid:200002733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwenet.org",nocase; classtype:attempted-recon; sid:200002734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwisalltrack.com",nocase; classtype:attempted-recon; sid:200002735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwred.4ik87425pj-354refd.workers.dev",nocase; classtype:attempted-recon; sid:200002736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gyffhjkkkh.verigghygy.websbl-verification.ru",nocase; classtype:attempted-recon; sid:200002737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gz32tf89tx00xz.byethost11.com",nocase; classtype:attempted-recon; sid:200002738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h45as.hyperphp.com",nocase; classtype:attempted-recon; sid:200002739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5brzd.webwave.dev",nocase; classtype:attempted-recon; sid:200002740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; classtype:attempted-recon; sid:200002741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h62g.nichesite.org",nocase; classtype:attempted-recon; sid:200002742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"habbocreditosparati.blogspot.com",nocase; classtype:attempted-recon; sid:200002743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hagalepuesmijo.byethost32.com",nocase; classtype:attempted-recon; sid:200002744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hahdaeupdate.es.tl",nocase; classtype:attempted-recon; sid:200002745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halaisabudhabi.com",nocase; classtype:attempted-recon; sid:200002746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"half-lifetimes.com",nocase; classtype:attempted-recon; sid:200002747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hali-securesuite.com",nocase; classtype:attempted-recon; sid:200002748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-checkthispayee.com",nocase; classtype:attempted-recon; sid:200002749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-online-bank.com",nocase; classtype:attempted-recon; sid:200002750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-securelink.com",nocase; classtype:attempted-recon; sid:200002751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-security-de-register-device.com",nocase; classtype:attempted-recon; sid:200002752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax.deregister-cancellation-payee-secure-auth.com",nocase; classtype:attempted-recon; sid:200002753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haliuk-secure-device.com",nocase; classtype:attempted-recon; sid:200002754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hamzabilisim.net",nocase; classtype:attempted-recon; sid:200002755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hangfashion.com.vn",nocase; classtype:attempted-recon; sid:200002756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hans-ledlite.com",nocase; classtype:attempted-recon; sid:200002757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"happyhouru.com",nocase; classtype:attempted-recon; sid:200002758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"harborstars.info",nocase; classtype:attempted-recon; sid:200002759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haroldhazard1-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"harshwardhan4k.github.io",nocase; classtype:attempted-recon; sid:200002761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasadom1.com",nocase; classtype:attempted-recon; sid:200002762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasmob.com",nocase; classtype:attempted-recon; sid:200002763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasseanhannitybeenwaterboarded.com",nocase; classtype:attempted-recon; sid:200002764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"havenscloudkitchen.com",nocase; classtype:attempted-recon; sid:200002765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hb-promerica-sv.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hb-promerica.hostfree.pw",nocase; classtype:attempted-recon; sid:200002767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hbomaxfreetrial.com",nocase; classtype:attempted-recon; sid:200002768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hc1.checker.in",nocase; classtype:attempted-recon; sid:200002769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hcnprdvz.azureedge.net",nocase; classtype:attempted-recon; sid:200002770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hdmediahub.club",nocase; classtype:attempted-recon; sid:200002771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hecticgymwear.com",nocase; classtype:attempted-recon; sid:200002772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hefjj.cn",nocase; classtype:attempted-recon; sid:200002773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helindo.id",nocase; classtype:attempted-recon; sid:200002774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helloparis.co.uk",nocase; classtype:attempted-recon; sid:200002775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-aku-dapat-boostposst-00125155.web.id",nocase; classtype:attempted-recon; sid:200002776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-center-notice-comunity-6532.web.id",nocase; classtype:attempted-recon; sid:200002777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-dbs.net",nocase; classtype:attempted-recon; sid:200002778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-notice-center-identity-6532.web.id",nocase; classtype:attempted-recon; sid:200002779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-star.ophera.me",nocase; classtype:attempted-recon; sid:200002780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help.mediashareiq.com",nocase; classtype:attempted-recon; sid:200002781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpdesk-tech.com",nocase; classtype:attempted-recon; sid:200002782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppss-konfiguresion131wq.cf",nocase; classtype:attempted-recon; sid:200002783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppss-validtionss131wq.gq",nocase; classtype:attempted-recon; sid:200002784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heppler.ch.net2care.com",nocase; classtype:attempted-recon; sid:200002785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsbahis01.blogspot.com",nocase; classtype:attempted-recon; sid:200002786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahiis1.blogspot.com",nocase; classtype:attempted-recon; sid:200002787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200002788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200002789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200002790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetershaven.net",nocase; classtype:attempted-recon; sid:200002791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetrios.com.br",nocase; classtype:attempted-recon; sid:200002792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetsa.com.mx",nocase; classtype:attempted-recon; sid:200002793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heuristic-lehmann.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200002794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hexagone.cloud",nocase; classtype:attempted-recon; sid:200002795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hftjyhtmhmwnjcetaqgmandubxnkft.10001mb.com",nocase; classtype:attempted-recon; sid:200002796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hgn2t.app.link",nocase; classtype:attempted-recon; sid:200002797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhfjjehnnnmkkfjnmmju.odoo.com",nocase; classtype:attempted-recon; sid:200002798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhjkjt.cn",nocase; classtype:attempted-recon; sid:200002799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhqqmmylkgw.typeform.com",nocase; classtype:attempted-recon; sid:200002800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hi.switchy.io",nocase; classtype:attempted-recon; sid:200002801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hide-windows.com",nocase; classtype:attempted-recon; sid:200002802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"higufytdfghlk98.weeblysite.com",nocase; classtype:attempted-recon; sid:200002803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"himalayansherpa.com.au",nocase; classtype:attempted-recon; sid:200002804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hindmovie.cc",nocase; classtype:attempted-recon; sid:200002805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hing.servebeer.com",nocase; classtype:attempted-recon; sid:200002806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitechmultieducation.in",nocase; classtype:attempted-recon; sid:200002807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitman71hd-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitpe.com",nocase; classtype:attempted-recon; sid:200002809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hiwream.cyou",nocase; classtype:attempted-recon; sid:200002810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hjkfj.ml",nocase; classtype:attempted-recon; sid:200002811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hk.mikecrm.com",nocase; classtype:attempted-recon; sid:200002812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hlpmnza.rf.gd",nocase; classtype:attempted-recon; sid:200002813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hm-revenue-costums.ciclosew.com",nocase; classtype:attempted-recon; sid:200002814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hm.ru",nocase; classtype:attempted-recon; sid:200002815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmlkl.codesandbox.io",nocase; classtype:attempted-recon; sid:200002816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmrc.gov.uk.mechcaddesign.com.au",nocase; classtype:attempted-recon; sid:200002817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hockian.com",nocase; classtype:attempted-recon; sid:200002818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hof-barth.de",nocase; classtype:attempted-recon; sid:200002819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holatoronto.com",nocase; classtype:attempted-recon; sid:200002820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holdmembershipntfx.aulaseidec.com",nocase; classtype:attempted-recon; sid:200002821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holidayinnboston.com",nocase; classtype:attempted-recon; sid:200002822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holiganguncelgir.blogspot.com",nocase; classtype:attempted-recon; sid:200002823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hollubarsch.de",nocase; classtype:attempted-recon; sid:200002824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holly-tangy-athlete.glitch.me",nocase; classtype:attempted-recon; sid:200002825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holstershub.com",nocase; classtype:attempted-recon; sid:200002826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holyrichesglobal.com",nocase; classtype:attempted-recon; sid:200002827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home-page.uniswups.one",nocase; classtype:attempted-recon; sid:200002828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home-spk-online.com",nocase; classtype:attempted-recon; sid:200002829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.bt-account-info.com",nocase; classtype:attempted-recon; sid:200002830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.ei1ns.de",nocase; classtype:attempted-recon; sid:200002831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.myfairpoint.net",nocase; classtype:attempted-recon; sid:200002832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home08bt.weebly.com",nocase; classtype:attempted-recon; sid:200002833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home11bt.weebly.com",nocase; classtype:attempted-recon; sid:200002834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homebak1lgalici.byethost31.com",nocase; classtype:attempted-recon; sid:200002835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homebtinc21.weebly.com",nocase; classtype:attempted-recon; sid:200002836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homebtyty31.boxmode.io",nocase; classtype:attempted-recon; sid:200002837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homedesignz.co.uk",nocase; classtype:attempted-recon; sid:200002838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homegrown.dynastyapp.org",nocase; classtype:attempted-recon; sid:200002839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homeid-spk.com",nocase; classtype:attempted-recon; sid:200002840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homelogspk.com",nocase; classtype:attempted-recon; sid:200002841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homepage-spk-log.com",nocase; classtype:attempted-recon; sid:200002842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homeservicespk.com",nocase; classtype:attempted-recon; sid:200002843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homesinlogin.com",nocase; classtype:attempted-recon; sid:200002844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homesuuport.xyz",nocase; classtype:attempted-recon; sid:200002845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homologacao.madrugadaolanches.com.br",nocase; classtype:attempted-recon; sid:200002846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homzinterior.com",nocase; classtype:attempted-recon; sid:200002847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honda4fun.com",nocase; classtype:attempted-recon; sid:200002848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honeyfm.lk",nocase; classtype:attempted-recon; sid:200002849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honeygarden.in",nocase; classtype:attempted-recon; sid:200002850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hope-polska.live",nocase; classtype:attempted-recon; sid:200002851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hopeforfuture.org.in",nocase; classtype:attempted-recon; sid:200002852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"horosho.house",nocase; classtype:attempted-recon; sid:200002853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2021623.online.pro",nocase; classtype:attempted-recon; sid:200002854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2024700.online.pro",nocase; classtype:attempted-recon; sid:200002855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2042037.online.pro",nocase; classtype:attempted-recon; sid:200002856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2070987.online.pro",nocase; classtype:attempted-recon; sid:200002857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2086464.online.pro",nocase; classtype:attempted-recon; sid:200002858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostnix.net",nocase; classtype:attempted-recon; sid:200002859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.1200028f.net2care.com",nocase; classtype:attempted-recon; sid:200002860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.121c0291.net2care.com",nocase; classtype:attempted-recon; sid:200002861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.148002bf.net2care.com",nocase; classtype:attempted-recon; sid:200002862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.14ec02c0.net2care.com",nocase; classtype:attempted-recon; sid:200002863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.17a902ef.tcorner.fr",nocase; classtype:attempted-recon; sid:200002864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.hebetec.ch.p2aexpertise.com",nocase; classtype:attempted-recon; sid:200002865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostvmses.00svmvoice.xyz",nocase; classtype:attempted-recon; sid:200002866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostyoutube.byethost14.com",nocase; classtype:attempted-recon; sid:200002867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hot-sofupqlgmsi.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotbrooks.com",nocase; classtype:attempted-recon; sid:200002869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotel-pontos.gr",nocase; classtype:attempted-recon; sid:200002870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelaakashresidency.com",nocase; classtype:attempted-recon; sid:200002871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelroyale.ro",nocase; classtype:attempted-recon; sid:200002872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelsanantonio.com.mx",nocase; classtype:attempted-recon; sid:200002873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotgrub.mlbb732.ga",nocase; classtype:attempted-recon; sid:200002874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hounbvc-c7661.web.app",nocase; classtype:attempted-recon; sid:200002875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"houstonaeure.tk",nocase; classtype:attempted-recon; sid:200002876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"howeverted.com",nocase; classtype:attempted-recon; sid:200002877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"howrse.5v.pl",nocase; classtype:attempted-recon; sid:200002878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hoynoticias.com.ar",nocase; classtype:attempted-recon; sid:200002879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpplotters.in",nocase; classtype:attempted-recon; sid:200002881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrs-game.main.jp",nocase; classtype:attempted-recon; sid:200002882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-19982318.t.hubspotfree.net",nocase; classtype:attempted-recon; sid:200002883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-giveaways.ca",nocase; classtype:attempted-recon; sid:200002884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hsbcinfo.com",nocase; classtype:attempted-recon; sid:200002885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hshny.com.cn",nocase; classtype:attempted-recon; sid:200002886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht-cargo.com.vn",nocase; classtype:attempted-recon; sid:200002887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200002888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200002889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpeugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-account00705321747217597012.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-account46223291521519296875.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-account54404216291050434462.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-account79565726483507087471.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-account87671972811134525682.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-qif9fxw1.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-r51znzih8i.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-z1au8cxghl.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsgmx-upgrade-verification-admin-updates-websitess-website.yolasite.com",nocase; classtype:attempted-recon; sid:200002899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsmarketplace.facebook.com-um3h7a1tz.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsmarketplace.facebook.com-y44hj1jesb.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsmarketplace.facebook.com-zj07679bw4.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"htwww.duluxautosales.com",nocase; classtype:attempted-recon; sid:200002903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hu.2021store.ru",nocase; classtype:attempted-recon; sid:200002904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huispeter.be",nocase; classtype:attempted-recon; sid:200002905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huksmakf.square.site",nocase; classtype:attempted-recon; sid:200002906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200002907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200002908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu.sitey.me",nocase; classtype:attempted-recon; sid:200002909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humani.biz",nocase; classtype:attempted-recon; sid:200002910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humc.in",nocase; classtype:attempted-recon; sid:200002911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hunehfufrk1verification.myaccount2021.ru",nocase; classtype:attempted-recon; sid:200002912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntingtononline.ddns.info",nocase; classtype:attempted-recon; sid:200002913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hutoknepper.de",nocase; classtype:attempted-recon; sid:200002914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huwo.xyz",nocase; classtype:attempted-recon; sid:200002915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huynguyen2k.github.io",nocase; classtype:attempted-recon; sid:200002916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwazen.com",nocase; classtype:attempted-recon; sid:200002917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwnucqurhkwupnpauxeuetfgaymrnj.66ghz.com",nocase; classtype:attempted-recon; sid:200002918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwzyw.csb.app",nocase; classtype:attempted-recon; sid:200002919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hydratrader.com",nocase; classtype:attempted-recon; sid:200002920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hypegames.shop",nocase; classtype:attempted-recon; sid:200002921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hziomas.cyou",nocase; classtype:attempted-recon; sid:200002922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-ask332.dga.jp",nocase; classtype:attempted-recon; sid:200002923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-kiwi.com.ua",nocase; classtype:attempted-recon; sid:200002924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i4us.com",nocase; classtype:attempted-recon; sid:200002925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ialvkqkadlmcdltczoqpwoociz-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iamkevinfay.com",nocase; classtype:attempted-recon; sid:200002927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iampranay.com",nocase; classtype:attempted-recon; sid:200002928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iamwatch.net",nocase; classtype:attempted-recon; sid:200002929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibank.qnbfinansbkonline.com",nocase; classtype:attempted-recon; sid:200002930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibanking.securedtrust-bn.com",nocase; classtype:attempted-recon; sid:200002931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibelongtotheworld.com",nocase; classtype:attempted-recon; sid:200002932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iberdulces.com",nocase; classtype:attempted-recon; sid:200002933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibpm.ru",nocase; classtype:attempted-recon; sid:200002934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ic-cite.ulm.ac.id",nocase; classtype:attempted-recon; sid:200002935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icis.iainponorogo.ac.id",nocase; classtype:attempted-recon; sid:200002936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icloud.info.et",nocase; classtype:attempted-recon; sid:200002937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icscard-services.particulierszaken-onlinemenu.eu",nocase; classtype:attempted-recon; sid:200002938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icscards-actualisatieformulier.18130-2078.s2.webspace.re",nocase; classtype:attempted-recon; sid:200002939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icscards.nl-privateserver.eu",nocase; classtype:attempted-recon; sid:200002940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icscards.servicedienst-privateserver.eu",nocase; classtype:attempted-recon; sid:200002941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icscards.wijziging-mijndiensten.eu",nocase; classtype:attempted-recon; sid:200002942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icy-mud-45aa.admin6854.workers.dev",nocase; classtype:attempted-recon; sid:200002943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"id-gandi.cll-cloud.de",nocase; classtype:attempted-recon; sid:200002944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"id-pour-vous-identifier-sur-votre-compte.yolasite.com",nocase; classtype:attempted-recon; sid:200002945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idam-web-public.aat.platform.hmcts.net",nocase; classtype:attempted-recon; sid:200002946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iddeev.hyperphp.com",nocase; classtype:attempted-recon; sid:200002947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-mescomptesv1.cf",nocase; classtype:attempted-recon; sid:200002948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-principalev1.cf",nocase; classtype:attempted-recon; sid:200002949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identifiez-vous-avec-votre-compte.yolasite.com",nocase; classtype:attempted-recon; sid:200002950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identifiez-vous598.yolasite.com",nocase; classtype:attempted-recon; sid:200002951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identify.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identita.n26.com.verificatoinformazioni.com",nocase; classtype:attempted-recon; sid:200002953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identityver-acc.centretvntf.biz.pl",nocase; classtype:attempted-recon; sid:200002954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identityver-acc.centretvntf.com.pl",nocase; classtype:attempted-recon; sid:200002955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identityver-acc.vercentretv.cam",nocase; classtype:attempted-recon; sid:200002956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idfleboncoin.com",nocase; classtype:attempted-recon; sid:200002957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idhuman-verification.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idiomas247.com",nocase; classtype:attempted-recon; sid:200002959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idmessagerieproorange.moonfruit.com",nocase; classtype:attempted-recon; sid:200002960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idorangefr24.yolasite.com",nocase; classtype:attempted-recon; sid:200002961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idsoluciones.co",nocase; classtype:attempted-recon; sid:200002962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idvalidatorterminal.com",nocase; classtype:attempted-recon; sid:200002963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idyktufvaykuqfwxaqkgkpavhhvzpx.66ghz.com",nocase; classtype:attempted-recon; sid:200002964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iframejld.avent-media.fr",nocase; classtype:attempted-recon; sid:200002965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ignitionclaim.com",nocase; classtype:attempted-recon; sid:200002966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igxe163.cn.com",nocase; classtype:attempted-recon; sid:200002967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ihwepnyvahyujdqaxjajxzrwddpfvd.66ghz.com",nocase; classtype:attempted-recon; sid:200002968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iiaosdffff.easy.co",nocase; classtype:attempted-recon; sid:200002969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iipvit.by",nocase; classtype:attempted-recon; sid:200002970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iksanthesharp.postown.net",nocase; classtype:attempted-recon; sid:200002971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikuhzdswpx.pfirmann-bau.de",nocase; classtype:attempted-recon; sid:200002972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikulutugrowthacademy.com",nocase; classtype:attempted-recon; sid:200002973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-3dinghhhsq.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-40548a5q.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-7jbmtszqrl.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-7jviqwaksl.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-9afo1gp37o.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-9dgz89pz4z.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-amnwraihk.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-c3t11vwg.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-c5t3c7phua.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-c6wv0b0nie.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-daf29dvdr.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-gjcdynj1.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-hwjds30pgp.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-k1sznm33.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-kew68ayl8h.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-kzqli7ca2m.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-mijtu80r.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-q2sxr1f5v9.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-q3wslgh4e.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-quigmal2p.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-r0y9yp964.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-s88udqtc7z.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-t8xyjg3n.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-tjc1ol85a.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-u654dgwino.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-utr0r92t.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-vxywqsfg.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200003000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-wt76mub9q.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200003001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-y930lpvbt1.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200003002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"img.maplejournal.co.in",nocase; classtype:attempted-recon; sid:200003003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imi.org.au",nocase; classtype:attempted-recon; sid:200003004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imobiliarianicacio.com.br",nocase; classtype:attempted-recon; sid:200003005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imobiliarianicacio.nicacioimobiliaria.com.br",nocase; classtype:attempted-recon; sid:200003006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impotspublicservice.com",nocase; classtype:attempted-recon; sid:200003007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressed-handler.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imsva91-ctp.trendmicro.com",nocase; classtype:attempted-recon; sid:200003009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"in-truck.dk",nocase; classtype:attempted-recon; sid:200003010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inbusinesscoworking.com",nocase; classtype:attempted-recon; sid:200003011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"index.kroppsfunktion.com",nocase; classtype:attempted-recon; sid:200003012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indexalimentos.com.mx",nocase; classtype:attempted-recon; sid:200003013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indha.in",nocase; classtype:attempted-recon; sid:200003014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indianvaastu.com",nocase; classtype:attempted-recon; sid:200003015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indigocoin.me",nocase; classtype:attempted-recon; sid:200003016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inf.trans-ope.com",nocase; classtype:attempted-recon; sid:200003017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infinitycare.gt",nocase; classtype:attempted-recon; sid:200003018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-45190a.web.app",nocase; classtype:attempted-recon; sid:200003019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-full18.2waky.com",nocase; classtype:attempted-recon; sid:200003020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-health-app.org",nocase; classtype:attempted-recon; sid:200003021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-online.it",nocase; classtype:attempted-recon; sid:200003022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.7tc2vz.cn",nocase; classtype:attempted-recon; sid:200003023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.cngygl.cn",nocase; classtype:attempted-recon; sid:200003024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.ipromoteuoffers.com",nocase; classtype:attempted-recon; sid:200003025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.lionnets.com",nocase; classtype:attempted-recon; sid:200003026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infobank.app.link",nocase; classtype:attempted-recon; sid:200003027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infodeseguros.com",nocase; classtype:attempted-recon; sid:200003028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infomation245.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informacionespsiquiatricas.com",nocase; classtype:attempted-recon; sid:200003030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"information.ingamazonstart.one",nocase; classtype:attempted-recon; sid:200003031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informationservice.toonlineamazoncardpresence.top",nocase; classtype:attempted-recon; sid:200003032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informationwarningadminpagesverified.co.vu",nocase; classtype:attempted-recon; sid:200003033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informe-enlineaacountt.eb2a.com",nocase; classtype:attempted-recon; sid:200003034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosecplace.com",nocase; classtype:attempted-recon; sid:200003035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosprologinmatrisemomols.yolasite.com",nocase; classtype:attempted-recon; sid:200003036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosysblog.php-dev.in",nocase; classtype:attempted-recon; sid:200003037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infotreegroup.com",nocase; classtype:attempted-recon; sid:200003038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ing-girokonto.sudanltd.com",nocase; classtype:attempted-recon; sid:200003039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ing.direct.verifica.dati.wellmom.net",nocase; classtype:attempted-recon; sid:200003040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ing.kluisrekening.nl.",nocase; classtype:attempted-recon; sid:200003041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingaveiculos.creatorlink.net",nocase; classtype:attempted-recon; sid:200003042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingreso-davivenda-transacciones.xyz",nocase; classtype:attempted-recon; sid:200003043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inhouse-spk-ob-center.com",nocase; classtype:attempted-recon; sid:200003044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inicio1viabcp-clientes.com",nocase; classtype:attempted-recon; sid:200003045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inicsido.vzpla.net",nocase; classtype:attempted-recon; sid:200003046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inno.surf",nocase; classtype:attempted-recon; sid:200003047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"innoaura.com",nocase; classtype:attempted-recon; sid:200003048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"innovationx.cc",nocase; classtype:attempted-recon; sid:200003049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpexcom-au.com",nocase; classtype:attempted-recon; sid:200003050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-genowefayf.id-info0343.me",nocase; classtype:attempted-recon; sid:200003051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl-3dsecure.id-safety.sbs",nocase; classtype:attempted-recon; sid:200003052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.059785.space",nocase; classtype:attempted-recon; sid:200003053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.226007.space",nocase; classtype:attempted-recon; sid:200003054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.6478954.space",nocase; classtype:attempted-recon; sid:200003055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.735913.space",nocase; classtype:attempted-recon; sid:200003056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.765849.space",nocase; classtype:attempted-recon; sid:200003057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.id-safety.digital",nocase; classtype:attempted-recon; sid:200003058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.reserv-safetrans.site",nocase; classtype:attempted-recon; sid:200003059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.transpay-order.site",nocase; classtype:attempted-recon; sid:200003060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-xjob.id-info0249.me",nocase; classtype:attempted-recon; sid:200003061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost.zaliczenie-platnosci.com",nocase; classtype:attempted-recon; sid:200003062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inps-ep.com",nocase; classtype:attempted-recon; sid:200003063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ins.cloudns.nz",nocase; classtype:attempted-recon; sid:200003064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insaafenterprisesinc.com",nocase; classtype:attempted-recon; sid:200003065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insidesoftwares.com",nocase; classtype:attempted-recon; sid:200003066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insighturdu.com",nocase; classtype:attempted-recon; sid:200003067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram-photo-battle-profile.ru",nocase; classtype:attempted-recon; sid:200003068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagramhelpp.agency",nocase; classtype:attempted-recon; sid:200003069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"institutodefaveri.com",nocase; classtype:attempted-recon; sid:200003070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insuminet.hostfree.pw",nocase; classtype:attempted-recon; sid:200003071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insuresfg.com",nocase; classtype:attempted-recon; sid:200003072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"integratedsolutions.it",nocase; classtype:attempted-recon; sid:200003073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intellidata-analytica.com",nocase; classtype:attempted-recon; sid:200003074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahis452.blogspot.com",nocase; classtype:attempted-recon; sid:200003075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirin.blogspot.com",nocase; classtype:attempted-recon; sid:200003076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirisadresimiz2.blogspot.com",nocase; classtype:attempted-recon; sid:200003077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200003078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbak.ws",nocase; classtype:attempted-recon; sid:200003079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbankempresas.pe-il.ru",nocase; classtype:attempted-recon; sid:200003080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbanlkweb.seguridadpfb.com",nocase; classtype:attempted-recon; sid:200003081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intercroofthlm.byethost33.com",nocase; classtype:attempted-recon; sid:200003082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interestingfurniture.com",nocase; classtype:attempted-recon; sid:200003083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interfacethlmt.byethost3.com",nocase; classtype:attempted-recon; sid:200003084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intergirisi.blogspot.com",nocase; classtype:attempted-recon; sid:200003085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interiorsbis.com",nocase; classtype:attempted-recon; sid:200003086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interlbankwelb.artagentsinternational.com",nocase; classtype:attempted-recon; sid:200003087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intern-girokunden-spk.com",nocase; classtype:attempted-recon; sid:200003088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intern.unibas-com.ch",nocase; classtype:attempted-recon; sid:200003089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"international-services.ni6132741-1.web19.nitrado.hosting",nocase; classtype:attempted-recon; sid:200003090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interne-mail-checker.com",nocase; classtype:attempted-recon; sid:200003091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internem.be",nocase; classtype:attempted-recon; sid:200003092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internordia.com",nocase; classtype:attempted-recon; sid:200003093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intexargentina.com.ar",nocase; classtype:attempted-recon; sid:200003094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intheknowinspections.com",nocase; classtype:attempted-recon; sid:200003095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inthewildproductions.com",nocase; classtype:attempted-recon; sid:200003096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intralock.es",nocase; classtype:attempted-recon; sid:200003097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intranet.unsm.edu.pe",nocase; classtype:attempted-recon; sid:200003098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intrbnk.co",nocase; classtype:attempted-recon; sid:200003099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"investpl.work",nocase; classtype:attempted-recon; sid:200003100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invictuspower.com.br",nocase; classtype:attempted-recon; sid:200003101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invit-grubmabarzx.duckdns.org",nocase; classtype:attempted-recon; sid:200003102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.inbox.lv",nocase; classtype:attempted-recon; sid:200003103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"io.haardhoutveiling.com",nocase; classtype:attempted-recon; sid:200003104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ionosmailservice.s3.us-east-2.amazonaws.com",nocase; classtype:attempted-recon; sid:200003105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ip.mercari.btefmny.cn",nocase; classtype:attempted-recon; sid:200003106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipancekeswap.com",nocase; classtype:attempted-recon; sid:200003107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipay.open-pays.ru",nocase; classtype:attempted-recon; sid:200003108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipko-biznes-online.com",nocase; classtype:attempted-recon; sid:200003109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipko-biznes-pl.com",nocase; classtype:attempted-recon; sid:200003110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipkobiznes-pl.com",nocase; classtype:attempted-recon; sid:200003111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipkonline.com",nocase; classtype:attempted-recon; sid:200003112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.info",nocase; classtype:attempted-recon; sid:200003113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipod.co.za",nocase; classtype:attempted-recon; sid:200003114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipzvs.ru",nocase; classtype:attempted-recon; sid:200003115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iqwc-wavemebrinci-pola.misecure.com",nocase; classtype:attempted-recon; sid:200003116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irenterprises.in",nocase; classtype:attempted-recon; sid:200003117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irequest-beneficiary-removal.com",nocase; classtype:attempted-recon; sid:200003118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irisdigi-labs.com",nocase; classtype:attempted-recon; sid:200003119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irn-inc.com",nocase; classtype:attempted-recon; sid:200003120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-advance.com",nocase; classtype:attempted-recon; sid:200003121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-deliverymail.com",nocase; classtype:attempted-recon; sid:200003122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-form-approval19.com",nocase; classtype:attempted-recon; sid:200003123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-privacy.com",nocase; classtype:attempted-recon; sid:200003124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-refund-tax.submit-validation.com",nocase; classtype:attempted-recon; sid:200003125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-registrar.com",nocase; classtype:attempted-recon; sid:200003126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.gov.admin-mcas-gov.ms",nocase; classtype:attempted-recon; sid:200003127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.gov.mcas-gov.ms",nocase; classtype:attempted-recon; sid:200003128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irsgov.unaux.com",nocase; classtype:attempted-recon; sid:200003129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstds.com",nocase; classtype:attempted-recon; sid:200003130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irtaki.com",nocase; classtype:attempted-recon; sid:200003131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isabelleswindowdesignvestal.com",nocase; classtype:attempted-recon; sid:200003132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isfirsatibul.com",nocase; classtype:attempted-recon; sid:200003133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ishiuchi70th.fun",nocase; classtype:attempted-recon; sid:200003134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iskomorli.cc",nocase; classtype:attempted-recon; sid:200003135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ispan.net.np",nocase; classtype:attempted-recon; sid:200003136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"issc345enter.gb.net",nocase; classtype:attempted-recon; sid:200003137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"istudyalumni.com",nocase; classtype:attempted-recon; sid:200003138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isue-ideent-privacy-update-secu-recovriy-andromeda-44.web.id",nocase; classtype:attempted-recon; sid:200003139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200003140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-friedli.ch",nocase; classtype:attempted-recon; sid:200003141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-supportdesk.com",nocase; classtype:attempted-recon; sid:200003142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it.melnikhotels.com",nocase; classtype:attempted-recon; sid:200003143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itaauinf.byethost7.com",nocase; classtype:attempted-recon; sid:200003144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itac.edu.az",nocase; classtype:attempted-recon; sid:200003145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itaucardcancelamento.ml",nocase; classtype:attempted-recon; sid:200003146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itcentralsupport.net",nocase; classtype:attempted-recon; sid:200003147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itechcircle.com",nocase; classtype:attempted-recon; sid:200003148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ititw.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itiy.in",nocase; classtype:attempted-recon; sid:200003150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itmfreepu.com",nocase; classtype:attempted-recon; sid:200003151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itptrucking.com",nocase; classtype:attempted-recon; sid:200003152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itryratan.com",nocase; classtype:attempted-recon; sid:200003153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itsmdshahin.github.io",nocase; classtype:attempted-recon; sid:200003154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuhkj.r4f4vmtlso.workers.dev",nocase; classtype:attempted-recon; sid:200003155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iutdigne.free.fr",nocase; classtype:attempted-recon; sid:200003156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuyhfd.hyperphp.com",nocase; classtype:attempted-recon; sid:200003157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iwalletconnect.com",nocase; classtype:attempted-recon; sid:200003158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iyihidet.cc",nocase; classtype:attempted-recon; sid:200003159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"izcalttia.com",nocase; classtype:attempted-recon; sid:200003160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.7kt.caretek.com.au",nocase; classtype:attempted-recon; sid:200003161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j6rdc0.webwave.dev",nocase; classtype:attempted-recon; sid:200003162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j8sws.xyz",nocase; classtype:attempted-recon; sid:200003163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j9aolejd98d.typeform.com",nocase; classtype:attempted-recon; sid:200003164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jabkzahrimasjoun.blogspot.com",nocase; classtype:attempted-recon; sid:200003165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccsivr.vmenu.jp",nocase; classtype:attempted-recon; sid:200003166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jacelectrical.co.uk",nocase; classtype:attempted-recon; sid:200003167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jackbinaspuol.blogspot.com",nocase; classtype:attempted-recon; sid:200003168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jackrussellsforsale.com",nocase; classtype:attempted-recon; sid:200003169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jacobliston.com",nocase; classtype:attempted-recon; sid:200003170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jadebest.ru",nocase; classtype:attempted-recon; sid:200003171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jagex.nu",nocase; classtype:attempted-recon; sid:200003172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jagoanneon.co.vu",nocase; classtype:attempted-recon; sid:200003173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaigurudevnamprabhuka.in",nocase; classtype:attempted-recon; sid:200003174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jalfre.com",nocase; classtype:attempted-recon; sid:200003175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jam-023d.gitlab.io",nocase; classtype:attempted-recon; sid:200003176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jameshallybone.co.uk",nocase; classtype:attempted-recon; sid:200003177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jamesonpcapitalgroup.com",nocase; classtype:attempted-recon; sid:200003178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jasminsafaris.co.ke",nocase; classtype:attempted-recon; sid:200003179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jasonmaiolo.com",nocase; classtype:attempted-recon; sid:200003180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"javarockingland.com",nocase; classtype:attempted-recon; sid:200003181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jblakelaw.com",nocase; classtype:attempted-recon; sid:200003182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jcmusiclab.com",nocase; classtype:attempted-recon; sid:200003183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jctuitiononline.com.sg",nocase; classtype:attempted-recon; sid:200003184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jecb.jberdb.com",nocase; classtype:attempted-recon; sid:200003185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeffreybcam.net",nocase; classtype:attempted-recon; sid:200003186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeffvandewalle.com",nocase; classtype:attempted-recon; sid:200003187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jenasurglcal.com",nocase; classtype:attempted-recon; sid:200003188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jenniangel.vzpla.net",nocase; classtype:attempted-recon; sid:200003189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jessiemichell.com",nocase; classtype:attempted-recon; sid:200003190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jetser-electrical-supply.business.site",nocase; classtype:attempted-recon; sid:200003191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jett.gator.site",nocase; classtype:attempted-recon; sid:200003192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jflkp.csb.app",nocase; classtype:attempted-recon; sid:200003193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jfovukvysqnglcjghfxncklqih-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jibnubank.com",nocase; classtype:attempted-recon; sid:200003195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jici001.cn",nocase; classtype:attempted-recon; sid:200003196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jide43977005.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200003197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jigthtfrri.duckdns.org",nocase; classtype:attempted-recon; sid:200003198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiikkjviuu.duckdns.org",nocase; classtype:attempted-recon; sid:200003199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jindaltextiles.com",nocase; classtype:attempted-recon; sid:200003200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiontnteegrubwhtsp.se.ke",nocase; classtype:attempted-recon; sid:200003201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiqpkgm.cn",nocase; classtype:attempted-recon; sid:200003202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiwanramchemical.com",nocase; classtype:attempted-recon; sid:200003203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jjaguar.com",nocase; classtype:attempted-recon; sid:200003204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jjec.jbcvdb.com",nocase; classtype:attempted-recon; sid:200003205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jjfurniturerepair.com",nocase; classtype:attempted-recon; sid:200003206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jjmuivuuzr.duckdns.org",nocase; classtype:attempted-recon; sid:200003207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jk3bt83s.r.eu-west-1.awstrack.me",nocase; classtype:attempted-recon; sid:200003208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jkbkubku1.weebly.com",nocase; classtype:attempted-recon; sid:200003209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jlogine.com",nocase; classtype:attempted-recon; sid:200003210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jmhyhjmvcp.duckdns.org",nocase; classtype:attempted-recon; sid:200003211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jmkpuztcsj.duckdns.org",nocase; classtype:attempted-recon; sid:200003212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jms-ibs.com",nocase; classtype:attempted-recon; sid:200003213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jnpccoaaff.duckdns.org",nocase; classtype:attempted-recon; sid:200003214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jobdonetech.com",nocase; classtype:attempted-recon; sid:200003215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jobme.pk",nocase; classtype:attempted-recon; sid:200003216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joe23.aidaform.com",nocase; classtype:attempted-recon; sid:200003217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joecamera.net",nocase; classtype:attempted-recon; sid:200003218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joeypmemorialfoundation.com",nocase; classtype:attempted-recon; sid:200003219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joeytorres.com",nocase; classtype:attempted-recon; sid:200003220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"john-ashley.de",nocase; classtype:attempted-recon; sid:200003221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-grub-berbagi18.duckdns.org",nocase; classtype:attempted-recon; sid:200003222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-grup-whatsapp0.duckdns.org",nocase; classtype:attempted-recon; sid:200003223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-grupbokep89.duckdns.org",nocase; classtype:attempted-recon; sid:200003224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-whatapp.otzo.com",nocase; classtype:attempted-recon; sid:200003225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-whatsappk8wh.xxuz.com",nocase; classtype:attempted-recon; sid:200003226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joindewasa.qpoe.com",nocase; classtype:attempted-recon; sid:200003227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingroup2.myz.info",nocase; classtype:attempted-recon; sid:200003228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinngrubwa.itsaol.com",nocase; classtype:attempted-recon; sid:200003229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinns.groups-sexs.duckdns.org",nocase; classtype:attempted-recon; sid:200003230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joins.groups-sexs.duckdns.org",nocase; classtype:attempted-recon; sid:200003231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinsgrupsz-whatsaappmput.duckdns.org",nocase; classtype:attempted-recon; sid:200003232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinsmput-whatsappgrups18.duckdns.org",nocase; classtype:attempted-recon; sid:200003233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jointsandspinecentre.com",nocase; classtype:attempted-recon; sid:200003234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinwhatsapp29.duckdns.org",nocase; classtype:attempted-recon; sid:200003235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joudialbarat.blogspot.com",nocase; classtype:attempted-recon; sid:200003236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joul.co.kr",nocase; classtype:attempted-recon; sid:200003237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jousthuy.love1world.ru",nocase; classtype:attempted-recon; sid:200003238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joyeriajireh.com.mx",nocase; classtype:attempted-recon; sid:200003239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp-mercaril.top",nocase; classtype:attempted-recon; sid:200003240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mecercearci.com",nocase; classtype:attempted-recon; sid:200003241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mecrcaeri.top",nocase; classtype:attempted-recon; sid:200003242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.meercarci.top",nocase; classtype:attempted-recon; sid:200003243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.meercarri.top",nocase; classtype:attempted-recon; sid:200003244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.menerceaoi.com",nocase; classtype:attempted-recon; sid:200003245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.menrcaroi.top",nocase; classtype:attempted-recon; sid:200003246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.meoercearei.com",nocase; classtype:attempted-recon; sid:200003247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mercarci.top",nocase; classtype:attempted-recon; sid:200003248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mercari.anets.cn",nocase; classtype:attempted-recon; sid:200003249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mercari.kc80m.cn",nocase; classtype:attempted-recon; sid:200003250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mercarri.top",nocase; classtype:attempted-recon; sid:200003251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200003252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mnercacri.top",nocase; classtype:attempted-recon; sid:200003253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.moercarni.top",nocase; classtype:attempted-recon; sid:200003254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.muercarei.top",nocase; classtype:attempted-recon; sid:200003255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jphdesigns.com.au",nocase; classtype:attempted-recon; sid:200003256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jpmcb03c-scredprtl03c.x24hr.com",nocase; classtype:attempted-recon; sid:200003257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jptechdocsign.net",nocase; classtype:attempted-recon; sid:200003258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrgiycrhat.duckdns.org",nocase; classtype:attempted-recon; sid:200003259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrhayley.plus.com",nocase; classtype:attempted-recon; sid:200003260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrlzdqi.wmsistseg.com.br",nocase; classtype:attempted-recon; sid:200003261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrtws.tk",nocase; classtype:attempted-recon; sid:200003262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jsbyv.app.link",nocase; classtype:attempted-recon; sid:200003263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jseptqgkpj.duckdns.org",nocase; classtype:attempted-recon; sid:200003264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jstrieb.github.io",nocase; classtype:attempted-recon; sid:200003265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtrffrrt.hyperphp.com",nocase; classtype:attempted-recon; sid:200003266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juandfar.github.io",nocase; classtype:attempted-recon; sid:200003267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juanthradio.com",nocase; classtype:attempted-recon; sid:200003268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"judysigner.cafe24.com",nocase; classtype:attempted-recon; sid:200003269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jun1.hyperphp.com",nocase; classtype:attempted-recon; sid:200003270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jurlebedev.ru",nocase; classtype:attempted-recon; sid:200003271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justgot.gonevis.com",nocase; classtype:attempted-recon; sid:200003272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justlookapp.com",nocase; classtype:attempted-recon; sid:200003273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justsayingbro.com",nocase; classtype:attempted-recon; sid:200003274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justying12.backrolled.ru",nocase; classtype:attempted-recon; sid:200003275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvjvfg.tk",nocase; classtype:attempted-recon; sid:200003276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvq2qlme6p9r7y9e3snh4wi1t-xsfenel96s9opo0durccau9z.glitch.me",nocase; classtype:attempted-recon; sid:200003277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jxmqdgdsrp.duckdns.org",nocase; classtype:attempted-recon; sid:200003278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jz2bab.webwave.dev",nocase; classtype:attempted-recon; sid:200003279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jzecqby.cn",nocase; classtype:attempted-recon; sid:200003280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k3ja6d.webwave.dev",nocase; classtype:attempted-recon; sid:200003281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k4je4zal.yolasite.com",nocase; classtype:attempted-recon; sid:200003282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k8923.csb.app",nocase; classtype:attempted-recon; sid:200003283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kaamwalibais.co.in",nocase; classtype:attempted-recon; sid:200003284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kagyulibrary.hk",nocase; classtype:attempted-recon; sid:200003285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kalaka.hargitamegye.ro",nocase; classtype:attempted-recon; sid:200003286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kalarirmalove.loveslife.biz",nocase; classtype:attempted-recon; sid:200003287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kammleads.com",nocase; classtype:attempted-recon; sid:200003288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"karenjob.com.br",nocase; classtype:attempted-recon; sid:200003289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kargonova.com",nocase; classtype:attempted-recon; sid:200003290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartaltepespor.com",nocase; classtype:attempted-recon; sid:200003291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartarky-online.cz",nocase; classtype:attempted-recon; sid:200003292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartclue.com",nocase; classtype:attempted-recon; sid:200003293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kashmir-packages.com",nocase; classtype:attempted-recon; sid:200003294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kashmirgrills.co.uk",nocase; classtype:attempted-recon; sid:200003295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kashmirharvard.edu.in",nocase; classtype:attempted-recon; sid:200003296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"katana.ronin-supports.com",nocase; classtype:attempted-recon; sid:200003297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbl-ltd.co.jp",nocase; classtype:attempted-recon; sid:200003298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kblessedmom.com.np",nocase; classtype:attempted-recon; sid:200003299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbs.co.ir",nocase; classtype:attempted-recon; sid:200003300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbstitchdesigns.com",nocase; classtype:attempted-recon; sid:200003301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbx1orln7nj.typeform.com",nocase; classtype:attempted-recon; sid:200003302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdbp6lzwnk.sisekuden0b0pinaycess.com",nocase; classtype:attempted-recon; sid:200003303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdlscaffolding.co.uk",nocase; classtype:attempted-recon; sid:200003304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecbearings.com",nocase; classtype:attempted-recon; sid:200003305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecc.com",nocase; classtype:attempted-recon; sid:200003306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecmanijada.com",nocase; classtype:attempted-recon; sid:200003307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keep-password-login-keep-account-keep.cloudns.ph",nocase; classtype:attempted-recon; sid:200003308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepactive-8k98-l9k8-98j8-98j78u-d3d3-fr3d34d-2.pages.dev",nocase; classtype:attempted-recon; sid:200003309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepboxactive-msoe3e3-osd2rrf432-d342f4-3f34e32edetferef.pages.dev",nocase; classtype:attempted-recon; sid:200003310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepit1.d1neg6m0awpus.amplifyapp.com",nocase; classtype:attempted-recon; sid:200003311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepscoin-giveaway.com",nocase; classtype:attempted-recon; sid:200003312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepspiritdesign.com",nocase; classtype:attempted-recon; sid:200003313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepupdate.ingamazoncardstart.one",nocase; classtype:attempted-recon; sid:200003314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepupdateto.ingamazoncardstart.one",nocase; classtype:attempted-recon; sid:200003315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepverifypass-keep-pass.cloudns.ph",nocase; classtype:attempted-recon; sid:200003316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kefu.pancackswap.com",nocase; classtype:attempted-recon; sid:200003317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kellsougsfrek.byethost17.com",nocase; classtype:attempted-recon; sid:200003318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kelpiesinc.com",nocase; classtype:attempted-recon; sid:200003319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ken.kulaklikdergisi.com",nocase; classtype:attempted-recon; sid:200003320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kenderland.com",nocase; classtype:attempted-recon; sid:200003321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kennel-buffing.com",nocase; classtype:attempted-recon; sid:200003322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kenyaembassyjuba.com",nocase; classtype:attempted-recon; sid:200003323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keramikadecor.com.ua",nocase; classtype:attempted-recon; sid:200003324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"key-drcp.com",nocase; classtype:attempted-recon; sid:200003325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"key-drop.vip",nocase; classtype:attempted-recon; sid:200003326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keyboardtreasures.com",nocase; classtype:attempted-recon; sid:200003327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keydrop.in",nocase; classtype:attempted-recon; sid:200003328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kfdg.omnicamp1.com",nocase; classtype:attempted-recon; sid:200003329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kh3wfp6f.easy.co",nocase; classtype:attempted-recon; sid:200003330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"khaloos.pk",nocase; classtype:attempted-recon; sid:200003331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"khayerinemoalem.ir",nocase; classtype:attempted-recon; sid:200003332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"khuranajewellers.com",nocase; classtype:attempted-recon; sid:200003333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kilshi.com",nocase; classtype:attempted-recon; sid:200003334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kimscakedesigns.com.au",nocase; classtype:attempted-recon; sid:200003335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kings-inn-ghost-satisfied.trycloudflare.com",nocase; classtype:attempted-recon; sid:200003336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kissapps.io",nocase; classtype:attempted-recon; sid:200003337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kit.mishkanhakavana.com",nocase; classtype:attempted-recon; sid:200003338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kitchno.com",nocase; classtype:attempted-recon; sid:200003339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjhghjhghjjh.weebly.com",nocase; classtype:attempted-recon; sid:200003340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjuu358.busymiddleman.xyz",nocase; classtype:attempted-recon; sid:200003341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjuu358.quantumflask.xyz",nocase; classtype:attempted-recon; sid:200003342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kkkksbellsouth.weebly.com",nocase; classtype:attempted-recon; sid:200003343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klick.wowtomation.io",nocase; classtype:attempted-recon; sid:200003344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klimadaos.finance",nocase; classtype:attempted-recon; sid:200003345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klimasdao.finance",nocase; classtype:attempted-recon; sid:200003346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klmailing.info",nocase; classtype:attempted-recon; sid:200003347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klockorochsmycken.se",nocase; classtype:attempted-recon; sid:200003348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klsjdlfkjqslfkjsdlkfjldsfjldsf.blogspot.com",nocase; classtype:attempted-recon; sid:200003349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klveiculosmontealto.com.br",nocase; classtype:attempted-recon; sid:200003350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"km4o0.codesandbox.io",nocase; classtype:attempted-recon; sid:200003351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"knowingthing.com",nocase; classtype:attempted-recon; sid:200003352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koerich-c-empresarial.com",nocase; classtype:attempted-recon; sid:200003353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kohrong.xyz",nocase; classtype:attempted-recon; sid:200003354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kojd6.app.link",nocase; classtype:attempted-recon; sid:200003355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kolkatafusion.com",nocase; classtype:attempted-recon; sid:200003356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kollo2030.com",nocase; classtype:attempted-recon; sid:200003357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kom-ma.de",nocase; classtype:attempted-recon; sid:200003358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konami-uefa-euro.net",nocase; classtype:attempted-recon; sid:200003359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200003360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konfliktagentur.de",nocase; classtype:attempted-recon; sid:200003361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konskij-vozbuditel.ru",nocase; classtype:attempted-recon; sid:200003362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kontoabgleichterminal.com",nocase; classtype:attempted-recon; sid:200003363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kontoopdatering.appleld.dk.opdatering.dspbrand.com",nocase; classtype:attempted-recon; sid:200003364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koreiamotors.com.br",nocase; classtype:attempted-recon; sid:200003365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koskas.activehosted.com",nocase; classtype:attempted-recon; sid:200003366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koteng.odoo.com",nocase; classtype:attempted-recon; sid:200003367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kotharibd.com",nocase; classtype:attempted-recon; sid:200003368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kovolem.cz",nocase; classtype:attempted-recon; sid:200003369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kozakbud.com.ua",nocase; classtype:attempted-recon; sid:200003370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kp.kralenexpres.nl",nocase; classtype:attempted-recon; sid:200003371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kqmthev.cluster030.hosting.ovh.net",nocase; classtype:attempted-recon; sid:200003372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kr-bithumb.web.app",nocase; classtype:attempted-recon; sid:200003373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kraken-acesso.com",nocase; classtype:attempted-recon; sid:200003374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krakenrums.blogspot.com",nocase; classtype:attempted-recon; sid:200003375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krakensignnto.xyz",nocase; classtype:attempted-recon; sid:200003376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kredikartdeneme.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krishnaprotabsolutions.co.in",nocase; classtype:attempted-recon; sid:200003378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krishnatheeram.co.in",nocase; classtype:attempted-recon; sid:200003379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kropiwnicki.com.pl",nocase; classtype:attempted-recon; sid:200003380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kscdcg.webwave.dev",nocase; classtype:attempted-recon; sid:200003381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kso-bw-bank-online.u1492093.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200003382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ksschool.org.in",nocase; classtype:attempted-recon; sid:200003383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kuchkuchnights.com",nocase; classtype:attempted-recon; sid:200003384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kulikovets.ru",nocase; classtype:attempted-recon; sid:200003385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kunden-service-agb.de",nocase; classtype:attempted-recon; sid:200003386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kundenpruefid2.xyz",nocase; classtype:attempted-recon; sid:200003387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurbanirgoru.com",nocase; classtype:attempted-recon; sid:200003388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurdistan-gallery.com",nocase; classtype:attempted-recon; sid:200003389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurortnoye.com.ua",nocase; classtype:attempted-recon; sid:200003390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kvfimhakzs.troy-bourgeois.workers.dev",nocase; classtype:attempted-recon; sid:200003391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kw.yourcarkw.com",nocase; classtype:attempted-recon; sid:200003392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kwarransragen.sragen.pramukajateng.or.id",nocase; classtype:attempted-recon; sid:200003393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kxqwaimhwu.duckdns.org",nocase; classtype:attempted-recon; sid:200003394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyqhradxak.duckdns.org",nocase; classtype:attempted-recon; sid:200003395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyyzbnamzq.duckdns.org",nocase; classtype:attempted-recon; sid:200003396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kzms.cit.net",nocase; classtype:attempted-recon; sid:200003397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l0ginsecured-gate7b-ssl6-ftp.cloudns.ph",nocase; classtype:attempted-recon; sid:200003398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l0ginway7-sslsecured-gate6b-ftp.cloudns.ph",nocase; classtype:attempted-recon; sid:200003399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l1zuo.codesandbox.io",nocase; classtype:attempted-recon; sid:200003400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l2royalties.com",nocase; classtype:attempted-recon; sid:200003401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"la13a8a5.justinstalledpanel.com",nocase; classtype:attempted-recon; sid:200003402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labanque-postalelbpnsservicessl.com",nocase; classtype:attempted-recon; sid:200003403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labogaya.ma",nocase; classtype:attempted-recon; sid:200003404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laboracionexacta.byethost6.com",nocase; classtype:attempted-recon; sid:200003405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labore-ma.blogspot.com",nocase; classtype:attempted-recon; sid:200003406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labpenjasfkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200003407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ladyrose-vl.ru",nocase; classtype:attempted-recon; sid:200003408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lafise.co",nocase; classtype:attempted-recon; sid:200003409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laibia.com",nocase; classtype:attempted-recon; sid:200003410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lakewoodpca.com",nocase; classtype:attempted-recon; sid:200003411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lakp.pl",nocase; classtype:attempted-recon; sid:200003412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lamaison.bc.ca",nocase; classtype:attempted-recon; sid:200003413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lambertair.com",nocase; classtype:attempted-recon; sid:200003414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laonc.ml",nocase; classtype:attempted-recon; sid:200003415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapiraterieestla.wixsite.com",nocase; classtype:attempted-recon; sid:200003416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laposada.roncesvalles.es",nocase; classtype:attempted-recon; sid:200003417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapotosinaexpress.com",nocase; classtype:attempted-recon; sid:200003418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laprospergroup.com",nocase; classtype:attempted-recon; sid:200003419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laptopfinance.org.uk",nocase; classtype:attempted-recon; sid:200003420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laraccount.com",nocase; classtype:attempted-recon; sid:200003421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larindbr.creatorlink.net",nocase; classtype:attempted-recon; sid:200003422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larvalab.to",nocase; classtype:attempted-recon; sid:200003423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lashibifuneralhomes.com",nocase; classtype:attempted-recon; sid:200003424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lasyaja.github.io",nocase; classtype:attempted-recon; sid:200003425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latinotravel.cz",nocase; classtype:attempted-recon; sid:200003426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latmasoud.persiangig.com",nocase; classtype:attempted-recon; sid:200003427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latrobebands.com",nocase; classtype:attempted-recon; sid:200003428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laughingstock.myvnc.com",nocase; classtype:attempted-recon; sid:200003429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lb.spaiemenylebc.com",nocase; classtype:attempted-recon; sid:200003430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbarncaporlnternet-lnterlbarnlk-pe.adveshcaui.xyz",nocase; classtype:attempted-recon; sid:200003431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbc.lebonvirement.com",nocase; classtype:attempted-recon; sid:200003432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbcpbonoyanapayonline.yanepay.com",nocase; classtype:attempted-recon; sid:200003433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbocpaylbc.com",nocase; classtype:attempted-recon; sid:200003434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lcdjh.codesandbox.io",nocase; classtype:attempted-recon; sid:200003435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ldsplanettt.yolasite.com",nocase; classtype:attempted-recon; sid:200003436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"le-diablotin-rouen.com",nocase; classtype:attempted-recon; sid:200003437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leadershipmail.org",nocase; classtype:attempted-recon; sid:200003438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lean-wellness.com.",nocase; classtype:attempted-recon; sid:200003439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leapstcyran.fr",nocase; classtype:attempted-recon; sid:200003440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"learningimpactmodel.com",nocase; classtype:attempted-recon; sid:200003441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leb.enreleboncoin.com",nocase; classtype:attempted-recon; sid:200003442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin-paiementsecured.paperform.co",nocase; classtype:attempted-recon; sid:200003443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin.la",nocase; classtype:attempted-recon; sid:200003444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinconnect.ru",nocase; classtype:attempted-recon; sid:200003445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinf.connexionlbc.com",nocase; classtype:attempted-recon; sid:200003446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinsecupaiement.paperform.co",nocase; classtype:attempted-recon; sid:200003447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lecord.com",nocase; classtype:attempted-recon; sid:200003448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lefsb.csb.app",nocase; classtype:attempted-recon; sid:200003449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legalshield.com_client-authorize-id.2uvna-noiwm-bop7l-idjvr-kzk8u.bursavebiz.com",nocase; classtype:attempted-recon; sid:200003450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legendtitleagency.com",nocase; classtype:attempted-recon; sid:200003451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leilaotratorescxoficial.com",nocase; classtype:attempted-recon; sid:200003452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leitersadvogados.com.br",nocase; classtype:attempted-recon; sid:200003453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lemonyellowsun.com",nocase; classtype:attempted-recon; sid:200003454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lenagruessdich.net",nocase; classtype:attempted-recon; sid:200003455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lender.sandbox.natwest.poweredbydivido.com",nocase; classtype:attempted-recon; sid:200003456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leni-pisker.byethost7.com",nocase; classtype:attempted-recon; sid:200003457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leqleq.com",nocase; classtype:attempted-recon; sid:200003458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lerocice1911.blogspot.com",nocase; classtype:attempted-recon; sid:200003459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"letsjumpnj.com",nocase; classtype:attempted-recon; sid:200003460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lexnotes.com.ng",nocase; classtype:attempted-recon; sid:200003461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfamhoimdw.duckdns.org",nocase; classtype:attempted-recon; sid:200003462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfbydqyxvh.duckdns.org",nocase; classtype:attempted-recon; sid:200003463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfelelei.agilecrm.com",nocase; classtype:attempted-recon; sid:200003464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfgtrk.com",nocase; classtype:attempted-recon; sid:200003465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfikggqgcb.duckdns.org",nocase; classtype:attempted-recon; sid:200003466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lg-onecom-io.web.app",nocase; classtype:attempted-recon; sid:200003467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lgigmguahm.duckdns.org",nocase; classtype:attempted-recon; sid:200003468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lgxadzprhr.duckdns.org",nocase; classtype:attempted-recon; sid:200003469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"libegce.cn",nocase; classtype:attempted-recon; sid:200003470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"library-fifth-lt-juice.trycloudflare.com",nocase; classtype:attempted-recon; sid:200003471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"library.foraqsa.com",nocase; classtype:attempted-recon; sid:200003472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liezen-online.at",nocase; classtype:attempted-recon; sid:200003473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lightlink.com.cn",nocase; classtype:attempted-recon; sid:200003474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.cc",nocase; classtype:attempted-recon; sid:200003475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.com",nocase; classtype:attempted-recon; sid:200003476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"likecreeper.com",nocase; classtype:attempted-recon; sid:200003477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"likes.sabamedical.com",nocase; classtype:attempted-recon; sid:200003478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lilplay.com",nocase; classtype:attempted-recon; sid:200003479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"limboevent.com",nocase; classtype:attempted-recon; sid:200003480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"limitediario-gestionar-banrural.com",nocase; classtype:attempted-recon; sid:200003481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lindalpilcher.com",nocase; classtype:attempted-recon; sid:200003482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lindyandfriends.tw",nocase; classtype:attempted-recon; sid:200003483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"line.pay.me.llinome.info",nocase; classtype:attempted-recon; sid:200003484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linesoe.github.io",nocase; classtype:attempted-recon; sid:200003485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link-viral-bokeb-2021.duckdns.org",nocase; classtype:attempted-recon; sid:200003486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.eezzyshop.com",nocase; classtype:attempted-recon; sid:200003487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.app.fit.ba",nocase; classtype:attempted-recon; sid:200003488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin456.weebly.com",nocase; classtype:attempted-recon; sid:200003489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin476.weebly.com",nocase; classtype:attempted-recon; sid:200003490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkhealthsystem.com",nocase; classtype:attempted-recon; sid:200003491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linpromerxx1.byethost9.com",nocase; classtype:attempted-recon; sid:200003492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lion.main.jp",nocase; classtype:attempted-recon; sid:200003493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liongear.com",nocase; classtype:attempted-recon; sid:200003494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lirc.cep.edu.vn",nocase; classtype:attempted-recon; sid:200003495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"listennow.listen-message-view-message.cloudns.ph",nocase; classtype:attempted-recon; sid:200003496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"little-wood-23ca.abssupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200003497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liusanchuan.github.io",nocase; classtype:attempted-recon; sid:200003498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live-site.hopto.me",nocase; classtype:attempted-recon; sid:200003499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live-swap.niswaps.com",nocase; classtype:attempted-recon; sid:200003500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live.rawfednews.com",nocase; classtype:attempted-recon; sid:200003501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live3jertech833.byethost7.com",nocase; classtype:attempted-recon; sid:200003502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livecryptolab.com",nocase; classtype:attempted-recon; sid:200003503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livewalletkonnect.com",nocase; classtype:attempted-recon; sid:200003504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livinglawsociety.org",nocase; classtype:attempted-recon; sid:200003505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljamzylykk.duckdns.org",nocase; classtype:attempted-recon; sid:200003506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljhhhzlmzy.duckdns.org",nocase; classtype:attempted-recon; sid:200003507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljhjdxyzbn.duckdns.org",nocase; classtype:attempted-recon; sid:200003508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljiuzzllkk.duckdns.org",nocase; classtype:attempted-recon; sid:200003509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljwwwjutfe.duckdns.org",nocase; classtype:attempted-recon; sid:200003510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lkt.bio",nocase; classtype:attempted-recon; sid:200003511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lladrousa.com",nocase; classtype:attempted-recon; sid:200003512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"llemenprojly.weebly.com",nocase; classtype:attempted-recon; sid:200003513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-accountbreach.com",nocase; classtype:attempted-recon; sid:200003514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-connect-payee.com",nocase; classtype:attempted-recon; sid:200003515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-devicehelp.com",nocase; classtype:attempted-recon; sid:200003516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-online-secures.com",nocase; classtype:attempted-recon; sid:200003517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-secure-customers.com",nocase; classtype:attempted-recon; sid:200003518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-support-team.com",nocase; classtype:attempted-recon; sid:200003519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbanking-securelogin.com",nocase; classtype:attempted-recon; sid:200003520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-bank-help-page.com",nocase; classtype:attempted-recon; sid:200003521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-payeecancellations.com",nocase; classtype:attempted-recon; sid:200003522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-uk-bank.com",nocase; classtype:attempted-recon; sid:200003523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.deregister-payee-secure-auth.com",nocase; classtype:attempted-recon; sid:200003524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.deregister-payee-security-auth.com",nocase; classtype:attempted-recon; sid:200003525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.login-personal-devices.com",nocase; classtype:attempted-recon; sid:200003526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-auth-verify-secure.com",nocase; classtype:attempted-recon; sid:200003527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-security-auth-verify.com",nocase; classtype:attempted-recon; sid:200003528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-visit-secure-auth.com",nocase; classtype:attempted-recon; sid:200003529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.personal-devices-login.com",nocase; classtype:attempted-recon; sid:200003530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.personal-login-secure-payee.com",nocase; classtype:attempted-recon; sid:200003531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.protect-secure-prevent.com",nocase; classtype:attempted-recon; sid:200003532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-device-protect.net",nocase; classtype:attempted-recon; sid:200003533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-online-deregister.com",nocase; classtype:attempted-recon; sid:200003534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-personal-device-login.com",nocase; classtype:attempted-recon; sid:200003535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyduk-newdevice-registered-online.com",nocase; classtype:attempted-recon; sid:200003536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyduk-online.com",nocase; classtype:attempted-recon; sid:200003537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"llsckhuhskcamuqwbonsrhwpvk-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmlenzitrasporti.com",nocase; classtype:attempted-recon; sid:200003539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmopoca.cn",nocase; classtype:attempted-recon; sid:200003540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmpots-gouv-dgsi.com",nocase; classtype:attempted-recon; sid:200003541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lms.ozyegin.edu.tr",nocase; classtype:attempted-recon; sid:200003542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnk.pmlti-etai-2.ovh",nocase; classtype:attempted-recon; sid:200003543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.dev",nocase; classtype:attempted-recon; sid:200003544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnstalam.eu",nocase; classtype:attempted-recon; sid:200003545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbancape-lbk.com",nocase; classtype:attempted-recon; sid:200003546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkhome.weworldnews.com",nocase; classtype:attempted-recon; sid:200003547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkpewelb.castlechemicals.sv2.cheshire-online.com",nocase; classtype:attempted-recon; sid:200003548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"load-cnfrmid.rf.gd",nocase; classtype:attempted-recon; sid:200003549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lobbygolf.org",nocase; classtype:attempted-recon; sid:200003550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"localbusinesscitationbuilding.com",nocase; classtype:attempted-recon; sid:200003551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"location-check.gb.net",nocase; classtype:attempted-recon; sid:200003552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lofon-add.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logex.com.tr",nocase; classtype:attempted-recon; sid:200003554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loghhtmls.byethost24.com",nocase; classtype:attempted-recon; sid:200003555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logienhalp3.tk",nocase; classtype:attempted-recon; sid:200003556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logienhalp5.tk",nocase; classtype:attempted-recon; sid:200003557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-api.unisweps.sbs",nocase; classtype:attempted-recon; sid:200003558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-bank.org",nocase; classtype:attempted-recon; sid:200003559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-live-com.office365.qacust1.fpcasbdev.com",nocase; classtype:attempted-recon; sid:200003560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-live.com-s02.net",nocase; classtype:attempted-recon; sid:200003561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-onlinebanking-suntrust-olb.net",nocase; classtype:attempted-recon; sid:200003562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-postfinance.com",nocase; classtype:attempted-recon; sid:200003563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-usps-97d157.ingress-daribow.easywp.com",nocase; classtype:attempted-recon; sid:200003564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.micro365ebs.gq",nocase; classtype:attempted-recon; sid:200003565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.o365.microservicess.tk",nocase; classtype:attempted-recon; sid:200003566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.privategold.uytrtyuhij987.gowithapex.com",nocase; classtype:attempted-recon; sid:200003567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.scl.swisscom.ch.ligalavuelta.com",nocase; classtype:attempted-recon; sid:200003568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.vdohnovenie.org.ua",nocase; classtype:attempted-recon; sid:200003569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login1006.wixsite.com",nocase; classtype:attempted-recon; sid:200003570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loginmercadopago.ml",nocase; classtype:attempted-recon; sid:200003571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logodesigningdubai.ae",nocase; classtype:attempted-recon; sid:200003572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logowanie-bezpieczna-online.com",nocase; classtype:attempted-recon; sid:200003573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logowanie24securebos.com",nocase; classtype:attempted-recon; sid:200003574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lokerpatscity.byethost33.com",nocase; classtype:attempted-recon; sid:200003575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lol-rakvten.ddnsking.com",nocase; classtype:attempted-recon; sid:200003576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lomadesarrollos.mx",nocase; classtype:attempted-recon; sid:200003577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lombard11.eu",nocase; classtype:attempted-recon; sid:200003578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonmakt.com",nocase; classtype:attempted-recon; sid:200003579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lookyoumall.ingamazonstart.top",nocase; classtype:attempted-recon; sid:200003580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lopn.planetwaves.am",nocase; classtype:attempted-recon; sid:200003581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loramera.ga",nocase; classtype:attempted-recon; sid:200003582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loto041219.blogspot.com",nocase; classtype:attempted-recon; sid:200003583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lotusengineering.in",nocase; classtype:attempted-recon; sid:200003584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"louyet.be",nocase; classtype:attempted-recon; sid:200003585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"love1world.ru",nocase; classtype:attempted-recon; sid:200003586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lovesouls.ru",nocase; classtype:attempted-recon; sid:200003587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lp.vp4.me",nocase; classtype:attempted-recon; sid:200003588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lqg8u8.webwave.dev",nocase; classtype:attempted-recon; sid:200003589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lsr-g0v-us.com",nocase; classtype:attempted-recon; sid:200003590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ltmhomes.org",nocase; classtype:attempted-recon; sid:200003591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lubmvv.cn",nocase; classtype:attempted-recon; sid:200003592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucie-inter.myshopwired.com",nocase; classtype:attempted-recon; sid:200003593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luckylkhraylbwal.blogspot.com",nocase; classtype:attempted-recon; sid:200003594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucy-walker.com",nocase; classtype:attempted-recon; sid:200003595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucywestpdaarubcorubber.org",nocase; classtype:attempted-recon; sid:200003596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ludiequip.es",nocase; classtype:attempted-recon; sid:200003597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luevoce.com",nocase; classtype:attempted-recon; sid:200003598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lukacsilevente.hu",nocase; classtype:attempted-recon; sid:200003599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lumail61.wixsite.com",nocase; classtype:attempted-recon; sid:200003600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunugrcpujwcfnajuctkojawrh-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxuriousmagazineasia.com",nocase; classtype:attempted-recon; sid:200003602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxuryautomobile.me",nocase; classtype:attempted-recon; sid:200003603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxustelekatermeszetben.hu",nocase; classtype:attempted-recon; sid:200003604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lvas.co.in",nocase; classtype:attempted-recon; sid:200003605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ly12-52.dazog.ge",nocase; classtype:attempted-recon; sid:200003606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lycee-ozanam35.fr",nocase; classtype:attempted-recon; sid:200003607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lynkos.com.br",nocase; classtype:attempted-recon; sid:200003608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.facebook-marketplace-6123125123412.codexina.com",nocase; classtype:attempted-recon; sid:200003609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.facebook-marketplace-891712.clinicalaserdepiel.com.ec",nocase; classtype:attempted-recon; sid:200003610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.facebook-marketplace-hha24172.tamco.com.sa",nocase; classtype:attempted-recon; sid:200003611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.facebook.com-message-861256312312.seanetng.com",nocase; classtype:attempted-recon; sid:200003612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.fb-page.jennybuck.com",nocase; classtype:attempted-recon; sid:200003613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.g2226.com",nocase; classtype:attempted-recon; sid:200003614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf165.com",nocase; classtype:attempted-recon; sid:200003615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf502.com",nocase; classtype:attempted-recon; sid:200003616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf739.com",nocase; classtype:attempted-recon; sid:200003617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.ncd8567.com",nocase; classtype:attempted-recon; sid:200003618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.nci8889.com",nocase; classtype:attempted-recon; sid:200003619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.wtr5378.com",nocase; classtype:attempted-recon; sid:200003620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m25g.22web.org",nocase; classtype:attempted-recon; sid:200003621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m42club.com",nocase; classtype:attempted-recon; sid:200003622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m54af8.webwave.dev",nocase; classtype:attempted-recon; sid:200003623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m6otljxfxrpy75aifbrx.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mabar-freefireaichan.duckdns.org",nocase; classtype:attempted-recon; sid:200003625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mabp.s-fr.net",nocase; classtype:attempted-recon; sid:200003626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"machineryzoneservice.com",nocase; classtype:attempted-recon; sid:200003627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macro-sistemas.com",nocase; classtype:attempted-recon; sid:200003628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maddho435st.gb.net",nocase; classtype:attempted-recon; sid:200003629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madeinluis067.byethost33.com",nocase; classtype:attempted-recon; sid:200003630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madens.com.pl",nocase; classtype:attempted-recon; sid:200003631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madras.com.br",nocase; classtype:attempted-recon; sid:200003632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madrhinoconsulting.com",nocase; classtype:attempted-recon; sid:200003633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madrugadaolanches.com.br",nocase; classtype:attempted-recon; sid:200003634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maestro.my.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200003635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magapravoce.com",nocase; classtype:attempted-recon; sid:200003636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magickallife.org",nocase; classtype:attempted-recon; sid:200003637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magicteachescoresubjects.com",nocase; classtype:attempted-recon; sid:200003638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magnuswatercraft.hu",nocase; classtype:attempted-recon; sid:200003639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maikhl0.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-account-verify-f4723.web.app",nocase; classtype:attempted-recon; sid:200003641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-gmxaktualisierung.yolasite.com",nocase; classtype:attempted-recon; sid:200003642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-oran-getest.duckdns.org",nocase; classtype:attempted-recon; sid:200003643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-ovhcloud.web.app",nocase; classtype:attempted-recon; sid:200003644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-reschedules.com",nocase; classtype:attempted-recon; sid:200003645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-ssocloud-srvr67yhguh.pages.dev",nocase; classtype:attempted-recon; sid:200003646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.02-bundle-help.com",nocase; classtype:attempted-recon; sid:200003647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.02-bundle-renewed.com",nocase; classtype:attempted-recon; sid:200003648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.02-update-bundle.com",nocase; classtype:attempted-recon; sid:200003649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.02bundle-renew.com",nocase; classtype:attempted-recon; sid:200003650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.34-125-214-216.cprapid.com",nocase; classtype:attempted-recon; sid:200003651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.34-130-46-74.cprapid.com",nocase; classtype:attempted-recon; sid:200003652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ab7553b08e5300472.temporary.link",nocase; classtype:attempted-recon; sid:200003653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.attorneyandpractice.com",nocase; classtype:attempted-recon; sid:200003654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bay81studios.com",nocase; classtype:attempted-recon; sid:200003655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.belvedereinfo.com",nocase; classtype:attempted-recon; sid:200003656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.blogdoaltivo.com.br",nocase; classtype:attempted-recon; sid:200003657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.charperimagedesign.com",nocase; classtype:attempted-recon; sid:200003658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.cicc.site",nocase; classtype:attempted-recon; sid:200003659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.citemachineries.com",nocase; classtype:attempted-recon; sid:200003660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.citiverifyuser.duckdns.org",nocase; classtype:attempted-recon; sid:200003661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.crueltybyclaire.com",nocase; classtype:attempted-recon; sid:200003662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.customer-1845.com",nocase; classtype:attempted-recon; sid:200003663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.customer-27301.com",nocase; classtype:attempted-recon; sid:200003664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.czechineseauction.com",nocase; classtype:attempted-recon; sid:200003665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.designandcraftsmanship.com",nocase; classtype:attempted-recon; sid:200003666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.easycoachltd.com",nocase; classtype:attempted-recon; sid:200003667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.electrumpanel.com",nocase; classtype:attempted-recon; sid:200003668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.enrollmoreclientsbootcamp.com",nocase; classtype:attempted-recon; sid:200003669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.fitgasmic.com",nocase; classtype:attempted-recon; sid:200003670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.gardenlog.com.br",nocase; classtype:attempted-recon; sid:200003671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.glui.eu",nocase; classtype:attempted-recon; sid:200003672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.grupdewasa-178.duckdns.org",nocase; classtype:attempted-recon; sid:200003673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.grupp18vral-vhk.duckdns.org",nocase; classtype:attempted-recon; sid:200003674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.grupwa-virall99.duckdns.org",nocase; classtype:attempted-recon; sid:200003675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.gtc.my",nocase; classtype:attempted-recon; sid:200003676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.harmonmedical.net",nocase; classtype:attempted-recon; sid:200003677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.hotelroyale.ro",nocase; classtype:attempted-recon; sid:200003678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.imobiliarianicacio.com.br",nocase; classtype:attempted-recon; sid:200003679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ims-fe.com",nocase; classtype:attempted-recon; sid:200003680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.intralock.es",nocase; classtype:attempted-recon; sid:200003681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.invit-grubmabarzx.duckdns.org",nocase; classtype:attempted-recon; sid:200003682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ispan.net.np",nocase; classtype:attempted-recon; sid:200003683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.join-grupbokep89.duckdns.org",nocase; classtype:attempted-recon; sid:200003684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.joingrub019.duckdns.org",nocase; classtype:attempted-recon; sid:200003685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.joinns.groups-sexs.duckdns.org",nocase; classtype:attempted-recon; sid:200003686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.joins.groups-sexs.duckdns.org",nocase; classtype:attempted-recon; sid:200003687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.joinsgrupsz-whatsaappmput.duckdns.org",nocase; classtype:attempted-recon; sid:200003688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.joinsmput-whatsappgrups18.duckdns.org",nocase; classtype:attempted-recon; sid:200003689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.kunsilindustry.com",nocase; classtype:attempted-recon; sid:200003690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.kuttabalfatih.com",nocase; classtype:attempted-recon; sid:200003691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.masswalker.com",nocase; classtype:attempted-recon; sid:200003692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mecfranchise.com",nocase; classtype:attempted-recon; sid:200003693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mestedfung.digital",nocase; classtype:attempted-recon; sid:200003694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mopxopeps.vn",nocase; classtype:attempted-recon; sid:200003695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mtb-secure05-verify.duckdns.org",nocase; classtype:attempted-recon; sid:200003696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200003697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.my-pass-info.com",nocase; classtype:attempted-recon; sid:200003698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.myo2-auth.com",nocase; classtype:attempted-recon; sid:200003699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.navarrotow.com",nocase; classtype:attempted-recon; sid:200003700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nicacioimobiliaria.com.br",nocase; classtype:attempted-recon; sid:200003701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nipunpharmaskill.com",nocase; classtype:attempted-recon; sid:200003702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nris.com.au",nocase; classtype:attempted-recon; sid:200003703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.o2uk-payeeinfo.com",nocase; classtype:attempted-recon; sid:200003704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.okepviral27.duckdns.org",nocase; classtype:attempted-recon; sid:200003705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.patsywaks.com",nocase; classtype:attempted-recon; sid:200003706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.phongvuexpress.vn",nocase; classtype:attempted-recon; sid:200003707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pocketinfotech.com",nocase; classtype:attempted-recon; sid:200003708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.privatgrub-bkp.duckdns.org",nocase; classtype:attempted-recon; sid:200003709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.queroquarto.com",nocase; classtype:attempted-recon; sid:200003710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.santepluspharma.com",nocase; classtype:attempted-recon; sid:200003711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.secure01ch.duckdns.org",nocase; classtype:attempted-recon; sid:200003712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.securityprivacy.live",nocase; classtype:attempted-recon; sid:200003713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.simrantruckrepairs.com",nocase; classtype:attempted-recon; sid:200003714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tariqalaraimi.com",nocase; classtype:attempted-recon; sid:200003715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.techlensusa.com",nocase; classtype:attempted-recon; sid:200003716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tenhoquarto.com",nocase; classtype:attempted-recon; sid:200003717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tenhoquarto.com.br",nocase; classtype:attempted-recon; sid:200003718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.testwebarif.duckdns.org",nocase; classtype:attempted-recon; sid:200003719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tycoongew.com",nocase; classtype:attempted-recon; sid:200003720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.updateinfo-billingo2.com",nocase; classtype:attempted-recon; sid:200003721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.vagheshvareeengworks.com",nocase; classtype:attempted-recon; sid:200003722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.virall41detikkk.duckdns.org",nocase; classtype:attempted-recon; sid:200003723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.visitgeorgiaonline.com",nocase; classtype:attempted-recon; sid:200003724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.whatsap-joinchat89bxyz.duckdns.org",nocase; classtype:attempted-recon; sid:200003725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.wheel1factory.net",nocase; classtype:attempted-recon; sid:200003726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.wolf.danswd.com",nocase; classtype:attempted-recon; sid:200003727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.zenstream.com",nocase; classtype:attempted-recon; sid:200003728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail2.mclink.it",nocase; classtype:attempted-recon; sid:200003729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailamazonfrom.ingamazonstart.xyz",nocase; classtype:attempted-recon; sid:200003730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailboxssddfd.creatorlink.net",nocase; classtype:attempted-recon; sid:200003731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailing.languedoc-roussillon.cci.fr",nocase; classtype:attempted-recon; sid:200003732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailmanager.engineread.gq",nocase; classtype:attempted-recon; sid:200003733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailplusrolerequestedprivatemailupdates.pages.dev",nocase; classtype:attempted-recon; sid:200003734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailserver7656566.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200003735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailssocloud-srvr65e6787.pages.dev",nocase; classtype:attempted-recon; sid:200003736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailupgrade2info.site44.com",nocase; classtype:attempted-recon; sid:200003737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailverificationadmin.com",nocase; classtype:attempted-recon; sid:200003738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mainehomeconnection.com",nocase; classtype:attempted-recon; sid:200003739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"majines.page.link",nocase; classtype:attempted-recon; sid:200003740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mala-riba.com",nocase; classtype:attempted-recon; sid:200003741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malaprontaargentina.com.br",nocase; classtype:attempted-recon; sid:200003742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mallmail.cloudns.ph",nocase; classtype:attempted-recon; sid:200003743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malu-taman.shop",nocase; classtype:attempted-recon; sid:200003744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malukutenggarakab.go.id",nocase; classtype:attempted-recon; sid:200003745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mamabearcoffee.com",nocase; classtype:attempted-recon; sid:200003746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mamameloweqweqwe.my-board.org",nocase; classtype:attempted-recon; sid:200003747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mamnondoremi.com.vn",nocase; classtype:attempted-recon; sid:200003748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"man-eating-lines.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"man1bantul.sch.id",nocase; classtype:attempted-recon; sid:200003750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manateetreeservice.com",nocase; classtype:attempted-recon; sid:200003751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mancomplain.com",nocase; classtype:attempted-recon; sid:200003752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mancomplain.net",nocase; classtype:attempted-recon; sid:200003753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mandmtextiles.com",nocase; classtype:attempted-recon; sid:200003754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manglam.in",nocase; classtype:attempted-recon; sid:200003755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mannahstore.com.br",nocase; classtype:attempted-recon; sid:200003756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mantemask.com",nocase; classtype:attempted-recon; sid:200003757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mantieniattivoiltuocontratto.marbooks.it",nocase; classtype:attempted-recon; sid:200003758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mantri.in",nocase; classtype:attempted-recon; sid:200003759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapsa.com.pe",nocase; classtype:attempted-recon; sid:200003760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marceluoribeiro.weebly.com",nocase; classtype:attempted-recon; sid:200003761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marckloper.vzpla.net",nocase; classtype:attempted-recon; sid:200003762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"margarita.md",nocase; classtype:attempted-recon; sid:200003763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"margtons.com",nocase; classtype:attempted-recon; sid:200003764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mariaeugeniafm.vzpla.net",nocase; classtype:attempted-recon; sid:200003765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markarokoe.co.vu",nocase; classtype:attempted-recon; sid:200003766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markazgroup.pk",nocase; classtype:attempted-recon; sid:200003767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markbids.com",nocase; classtype:attempted-recon; sid:200003768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketcecom.com",nocase; classtype:attempted-recon; sid:200003769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketcs-com.ru",nocase; classtype:attempted-recon; sid:200003770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplaces-axieinifinity.com",nocase; classtype:attempted-recon; sid:200003771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketray.xyz",nocase; classtype:attempted-recon; sid:200003772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketvit.by",nocase; classtype:attempted-recon; sid:200003773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markgoldbach.com",nocase; classtype:attempted-recon; sid:200003774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marktcscom.com",nocase; classtype:attempted-recon; sid:200003775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martimbangan.co.vu",nocase; classtype:attempted-recon; sid:200003776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martinsboots.shop",nocase; classtype:attempted-recon; sid:200003777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masaeilvo.com",nocase; classtype:attempted-recon; sid:200003778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mask-token.com",nocase; classtype:attempted-recon; sid:200003779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"massaget5456hera.gb.net",nocase; classtype:attempted-recon; sid:200003780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masterdrive.com",nocase; classtype:attempted-recon; sid:200003781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masterkitchen.pt",nocase; classtype:attempted-recon; sid:200003782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matamask.icu",nocase; classtype:attempted-recon; sid:200003783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matamask.uk",nocase; classtype:attempted-recon; sid:200003784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200003785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgirisimizgir.blogspot.com",nocase; classtype:attempted-recon; sid:200003786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"match.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200003787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matchoklahoma.com",nocase; classtype:attempted-recon; sid:200003788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matemask.biz",nocase; classtype:attempted-recon; sid:200003789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matixlogin.eshost.com.ar",nocase; classtype:attempted-recon; sid:200003790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matt-tiemanfloridarealestate.com",nocase; classtype:attempted-recon; sid:200003791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mattresscleaningabudhabi.com",nocase; classtype:attempted-recon; sid:200003792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibetgir5.blogspot.com",nocase; classtype:attempted-recon; sid:200003793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibets.blogspot.com",nocase; classtype:attempted-recon; sid:200003794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibett1.blogspot.com",nocase; classtype:attempted-recon; sid:200003795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibett11.blogspot.com",nocase; classtype:attempted-recon; sid:200003796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavinglobal.net",nocase; classtype:attempted-recon; sid:200003797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maw-enterprises.com.np",nocase; classtype:attempted-recon; sid:200003798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxclinic.ru",nocase; classtype:attempted-recon; sid:200003799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maximilianschnauzers.com",nocase; classtype:attempted-recon; sid:200003800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxis-winner-2020.webs.com",nocase; classtype:attempted-recon; sid:200003801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxpress.in",nocase; classtype:attempted-recon; sid:200003802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mayanktex.com",nocase; classtype:attempted-recon; sid:200003803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mayormoveis.com",nocase; classtype:attempted-recon; sid:200003804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maytinhphucanh.vn",nocase; classtype:attempted-recon; sid:200003805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mazinsamona.com",nocase; classtype:attempted-recon; sid:200003806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mbex.ru",nocase; classtype:attempted-recon; sid:200003807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mbkj.wokeja2898.workers.dev",nocase; classtype:attempted-recon; sid:200003808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mcazsri-accjp0.com",nocase; classtype:attempted-recon; sid:200003809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mccarthyelectrical.com",nocase; classtype:attempted-recon; sid:200003810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mcconcep.cluster005.ovh.net",nocase; classtype:attempted-recon; sid:200003811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mchganistore.solofolio.net",nocase; classtype:attempted-recon; sid:200003812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mckennittfamily.com",nocase; classtype:attempted-recon; sid:200003813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mclaren-org.org",nocase; classtype:attempted-recon; sid:200003814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mclegal.co.uk",nocase; classtype:attempted-recon; sid:200003815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdex.li",nocase; classtype:attempted-recon; sid:200003816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdurucan.com",nocase; classtype:attempted-recon; sid:200003817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mecfranchise.com",nocase; classtype:attempted-recon; sid:200003818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mediosdigitalescr.com",nocase; classtype:attempted-recon; sid:200003819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meditekergo.com",nocase; classtype:attempted-recon; sid:200003820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mednungtanpoudan-acvwe3.ga",nocase; classtype:attempted-recon; sid:200003821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medo.world",nocase; classtype:attempted-recon; sid:200003822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medscore.azurewebsites.net",nocase; classtype:attempted-recon; sid:200003823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medtamr.com",nocase; classtype:attempted-recon; sid:200003824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meemessateledrama.com",nocase; classtype:attempted-recon; sid:200003825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meetinaddis.com",nocase; classtype:attempted-recon; sid:200003826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meeting-23900123090123.bitbucket.io",nocase; classtype:attempted-recon; sid:200003827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"megacredi.com",nocase; classtype:attempted-recon; sid:200003828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"megasolar.lk",nocase; classtype:attempted-recon; sid:200003829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.mecaix.info",nocase; classtype:attempted-recon; sid:200003830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.yicio.info",nocase; classtype:attempted-recon; sid:200003831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meijiyasudai.com",nocase; classtype:attempted-recon; sid:200003832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meijiyasudal.com",nocase; classtype:attempted-recon; sid:200003833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mein.gebuhrenfrei.com",nocase; classtype:attempted-recon; sid:200003834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meinkonto-kontrol24.blogspot.com",nocase; classtype:attempted-recon; sid:200003835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mekelanmlock.byethost9.com",nocase; classtype:attempted-recon; sid:200003836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"melongroup.net",nocase; classtype:attempted-recon; sid:200003837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"members.theatrewomen.org",nocase; classtype:attempted-recon; sid:200003838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"membershipff.vn",nocase; classtype:attempted-recon; sid:200003839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mensajeriaexpressguatemala.com",nocase; classtype:attempted-recon; sid:200003840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercacay.com",nocase; classtype:attempted-recon; sid:200003841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercadoor.com",nocase; classtype:attempted-recon; sid:200003842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercaoi-8urwe.babidj.com",nocase; classtype:attempted-recon; sid:200003843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.cool",nocase; classtype:attempted-recon; sid:200003844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.ku1p.info",nocase; classtype:attempted-recon; sid:200003845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.ku2p.info",nocase; classtype:attempted-recon; sid:200003846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.ku3p.info",nocase; classtype:attempted-recon; sid:200003847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.ku4p.info",nocase; classtype:attempted-recon; sid:200003848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.lvyil.com",nocase; classtype:attempted-recon; sid:200003849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merssc.com",nocase; classtype:attempted-recon; sid:200003850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.mrjp.info",nocase; classtype:attempted-recon; sid:200003851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.shmet.info",nocase; classtype:attempted-recon; sid:200003852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.xjwool.com",nocase; classtype:attempted-recon; sid:200003853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercarii.top",nocase; classtype:attempted-recon; sid:200003854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercaril-co-jp.top",nocase; classtype:attempted-recon; sid:200003855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercatorgloves.com",nocase; classtype:attempted-recon; sid:200003856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meremanovegabana.website2.me",nocase; classtype:attempted-recon; sid:200003857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meriasia-co.top",nocase; classtype:attempted-recon; sid:200003858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericaproafterdu.byethost6.com",nocase; classtype:attempted-recon; sid:200003859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meriprocaseinbanfro.42web.io",nocase; classtype:attempted-recon; sid:200003860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"merveyilmazericmimarlik.com",nocase; classtype:attempted-recon; sid:200003861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meschinowellness.com",nocase; classtype:attempted-recon; sid:200003862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mesenvois.fr.swtest.ru",nocase; classtype:attempted-recon; sid:200003863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mesquecamping.es",nocase; classtype:attempted-recon; sid:200003864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerie-orange164.yolasite.com",nocase; classtype:attempted-recon; sid:200003865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerieseloger.unaux.com",nocase; classtype:attempted-recon; sid:200003866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerievocale.ctcin.bio",nocase; classtype:attempted-recon; sid:200003867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerievocale21.ctcin.bio",nocase; classtype:attempted-recon; sid:200003868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerievocalorg.yolasite.com",nocase; classtype:attempted-recon; sid:200003869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messelive.tv",nocase; classtype:attempted-recon; sid:200003870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mester.info.hu",nocase; classtype:attempted-recon; sid:200003871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestercartoonplanetjed3.blogspot.com",nocase; classtype:attempted-recon; sid:200003872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestersuperwingskb1a.blogspot.com",nocase; classtype:attempted-recon; sid:200003873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestersuperwingskb3c.blogspot.com",nocase; classtype:attempted-recon; sid:200003874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet1.blogspot.com",nocase; classtype:attempted-recon; sid:200003875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet2.blogspot.com",nocase; classtype:attempted-recon; sid:200003876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet3.blogspot.com",nocase; classtype:attempted-recon; sid:200003877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet4.blogspot.com",nocase; classtype:attempted-recon; sid:200003878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet5.blogspot.com",nocase; classtype:attempted-recon; sid:200003879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet6.blogspot.com",nocase; classtype:attempted-recon; sid:200003880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metal-servis.com",nocase; classtype:attempted-recon; sid:200003881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metallkom-spb.ru",nocase; classtype:attempted-recon; sid:200003882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metaltubos.com.br",nocase; classtype:attempted-recon; sid:200003883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaasck.com",nocase; classtype:attempted-recon; sid:200003884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamasc.club",nocase; classtype:attempted-recon; sid:200003885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-extension.com.hsurge.com",nocase; classtype:attempted-recon; sid:200003886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-web.info",nocase; classtype:attempted-recon; sid:200003887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.cam",nocase; classtype:attempted-recon; sid:200003888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.ltd",nocase; classtype:attempted-recon; sid:200003889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaskservicesweb.com",nocase; classtype:attempted-recon; sid:200003890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metavideos.com",nocase; classtype:attempted-recon; sid:200003891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metemask.net",nocase; classtype:attempted-recon; sid:200003892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"methoius.com",nocase; classtype:attempted-recon; sid:200003893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metomasks.one",nocase; classtype:attempted-recon; sid:200003894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metomosk.online",nocase; classtype:attempted-recon; sid:200003895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metroluxflowers.com",nocase; classtype:attempted-recon; sid:200003896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meusabor.com.br",nocase; classtype:attempted-recon; sid:200003897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meusacessocaixas.com",nocase; classtype:attempted-recon; sid:200003898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mf.rks-gov.net",nocase; classtype:attempted-recon; sid:200003899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.rs",nocase; classtype:attempted-recon; sid:200003900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.ru",nocase; classtype:attempted-recon; sid:200003901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhacrix.freecluster.eu",nocase; classtype:attempted-recon; sid:200003902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhercy-eb2e6.web.app",nocase; classtype:attempted-recon; sid:200003903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhora.com",nocase; classtype:attempted-recon; sid:200003904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miangroupofcompanies.com",nocase; classtype:attempted-recon; sid:200003905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mibancocrece.com.co",nocase; classtype:attempted-recon; sid:200003906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"michel.hyperphp.com",nocase; classtype:attempted-recon; sid:200003907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"michelecunningham.org",nocase; classtype:attempted-recon; sid:200003908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miciinegustori.ro",nocase; classtype:attempted-recon; sid:200003909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"micr0s0ftverify.nicepage.io",nocase; classtype:attempted-recon; sid:200003910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microcav.square.site",nocase; classtype:attempted-recon; sid:200003911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microdronesystems.com",nocase; classtype:attempted-recon; sid:200003912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft-excel.kr.jaleco.com",nocase; classtype:attempted-recon; sid:200003913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft01829.odoo.com",nocase; classtype:attempted-recon; sid:200003914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft0invoce.rf.gd",nocase; classtype:attempted-recon; sid:200003915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftloginverification.questionpro.com",nocase; classtype:attempted-recon; sid:200003916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftonedlrlve.typeform.com",nocase; classtype:attempted-recon; sid:200003917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftsecure-docucenterfile.questionpro.com",nocase; classtype:attempted-recon; sid:200003918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftwebserver.mfs.gg",nocase; classtype:attempted-recon; sid:200003919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microspromeri081.byethost22.com",nocase; classtype:attempted-recon; sid:200003920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microuuy.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microverifylink.github.io",nocase; classtype:attempted-recon; sid:200003922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"micuenta01.github.io",nocase; classtype:attempted-recon; sid:200003923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midati.com",nocase; classtype:attempted-recon; sid:200003924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midnightluna1.typeform.com",nocase; classtype:attempted-recon; sid:200003925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midshopping.ro",nocase; classtype:attempted-recon; sid:200003926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miecompany.8b.io",nocase; classtype:attempted-recon; sid:200003927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"migrosbank.nokmedia.com",nocase; classtype:attempted-recon; sid:200003928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mijnbuitenhuis.nl",nocase; classtype:attempted-recon; sid:200003929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mikakahla463.shoplineapp.com",nocase; classtype:attempted-recon; sid:200003930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mikelantes.vzpla.net",nocase; classtype:attempted-recon; sid:200003931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milamansa.com",nocase; classtype:attempted-recon; sid:200003932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanobet301.com",nocase; classtype:attempted-recon; sid:200003933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milateixeira.com.br",nocase; classtype:attempted-recon; sid:200003934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milavertofmultuservice.org",nocase; classtype:attempted-recon; sid:200003935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"militarybikers.org",nocase; classtype:attempted-recon; sid:200003936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millennium-bcp.org",nocase; classtype:attempted-recon; sid:200003937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniumstaffing.co.uk",nocase; classtype:attempted-recon; sid:200003938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miloserdie-rzn.ru",nocase; classtype:attempted-recon; sid:200003939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mimecast.fmlms.com",nocase; classtype:attempted-recon; sid:200003940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mimecast.swagonline.co.uk",nocase; classtype:attempted-recon; sid:200003941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minervabookstore.com",nocase; classtype:attempted-recon; sid:200003942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mineyilmazbilek.com",nocase; classtype:attempted-recon; sid:200003943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mingming20160152.github.io",nocase; classtype:attempted-recon; sid:200003944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ministry-offreedomka.app",nocase; classtype:attempted-recon; sid:200003945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miplab.net",nocase; classtype:attempted-recon; sid:200003946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mipymescolombiana.com",nocase; classtype:attempted-recon; sid:200003947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miracdoviz.com",nocase; classtype:attempted-recon; sid:200003948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miraclecraftshop.com",nocase; classtype:attempted-recon; sid:200003949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mirceachira.ro",nocase; classtype:attempted-recon; sid:200003950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"misdatosviabcp.live",nocase; classtype:attempted-recon; sid:200003951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missgarcia.com",nocase; classtype:attempted-recon; sid:200003952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missionshashank.org",nocase; classtype:attempted-recon; sid:200003953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mistake.serveftp.com",nocase; classtype:attempted-recon; sid:200003954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mistimbas.com",nocase; classtype:attempted-recon; sid:200003955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mitake-sh.com",nocase; classtype:attempted-recon; sid:200003956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mitoption.com",nocase; classtype:attempted-recon; sid:200003957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mivtsystems.com",nocase; classtype:attempted-recon; sid:200003958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixi.guru",nocase; classtype:attempted-recon; sid:200003959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixmytea.at",nocase; classtype:attempted-recon; sid:200003960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxixmjeydgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxiymjnyza.filesusr.com",nocase; classtype:attempted-recon; sid:200003962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1heta1dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetezmtj0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetgym3jk.filesusr.com",nocase; classtype:attempted-recon; sid:200003965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetizmtl0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetqymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200003967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetu3dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetuymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200003969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymufwcmlsmde5dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk1mtr0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhkzmtn0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmu0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmuymzfzda.filesusr.com",nocase; classtype:attempted-recon; sid:200003976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com",nocase; classtype:attempted-recon; sid:200003978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjxz.org",nocase; classtype:attempted-recon; sid:200003979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mk2.ge",nocase; classtype:attempted-recon; sid:200003980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mkengineering.com.my",nocase; classtype:attempted-recon; sid:200003981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mkiuyhakauywa.blogspot.com",nocase; classtype:attempted-recon; sid:200003982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mky.com",nocase; classtype:attempted-recon; sid:200003983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mmprsatx.com",nocase; classtype:attempted-recon; sid:200003984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mms.tucsonhispanicchamber.net",nocase; classtype:attempted-recon; sid:200003985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mmsportable.kissr.com",nocase; classtype:attempted-recon; sid:200003986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moaracubucate.ro",nocase; classtype:attempted-recon; sid:200003987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobiile.systemredirect-pages.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200003988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-alerts-o2.com",nocase; classtype:attempted-recon; sid:200003989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-alertsonline-ie.com",nocase; classtype:attempted-recon; sid:200003990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-orange-forever.yolasite.com",nocase; classtype:attempted-recon; sid:200003991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-portail.live",nocase; classtype:attempted-recon; sid:200003992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.appbradescoclientes.cadastrovalido.com",nocase; classtype:attempted-recon; sid:200003993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.de.user.inserat4453.de",nocase; classtype:attempted-recon; sid:200003994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.redirect-pages-app.leywds8uxm-zng4pdlwv4dp.p.runcloud.link",nocase; classtype:attempted-recon; sid:200003995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.retrocafe.net.au",nocase; classtype:attempted-recon; sid:200003996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobiledesbloqueio.com",nocase; classtype:attempted-recon; sid:200003997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobsuemil.com",nocase; classtype:attempted-recon; sid:200003998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobyleev3.com",nocase; classtype:attempted-recon; sid:200003999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mockup.metradigitalmedia.com",nocase; classtype:attempted-recon; sid:200004000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mocriminals.xyz",nocase; classtype:attempted-recon; sid:200004001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modasbrilhodosol.com",nocase; classtype:attempted-recon; sid:200004002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moderka-sklep.pl",nocase; classtype:attempted-recon; sid:200004003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mohammadimasjidnelson.co.uk",nocase; classtype:attempted-recon; sid:200004004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moj.aktiv.rs",nocase; classtype:attempted-recon; sid:200004005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"momentoslemadrid.com",nocase; classtype:attempted-recon; sid:200004006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mon-token.com",nocase; classtype:attempted-recon; sid:200004007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monaco-banking.com",nocase; classtype:attempted-recon; sid:200004008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monedri.xyz",nocase; classtype:attempted-recon; sid:200004009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monetiza.online-formacionveterinaria.com",nocase; classtype:attempted-recon; sid:200004010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monexde.com",nocase; classtype:attempted-recon; sid:200004011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moneyviewfinance.in",nocase; classtype:attempted-recon; sid:200004012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moni.bg",nocase; classtype:attempted-recon; sid:200004013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monirshouvo.github.io",nocase; classtype:attempted-recon; sid:200004014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monomobileservice.yolasite.com",nocase; classtype:attempted-recon; sid:200004015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monstercarp.rn86.ru",nocase; classtype:attempted-recon; sid:200004016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montaz.niedzwiedz-lock.pl",nocase; classtype:attempted-recon; sid:200004017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montmabesa1888.blogspot.com",nocase; classtype:attempted-recon; sid:200004018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monyeward.com",nocase; classtype:attempted-recon; sid:200004019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moodbbs.cn",nocase; classtype:attempted-recon; sid:200004020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moodle.lms-su.com",nocase; classtype:attempted-recon; sid:200004021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mopxopeps.vn",nocase; classtype:attempted-recon; sid:200004022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morioka9.com",nocase; classtype:attempted-recon; sid:200004023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morning-cloud-9b80.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200004024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morning-tree-7f87.valid-secr.workers.dev",nocase; classtype:attempted-recon; sid:200004025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mosvisa24.ru",nocase; classtype:attempted-recon; sid:200004026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motoci456klistywru.ru",nocase; classtype:attempted-recon; sid:200004027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motormoskito.cl",nocase; classtype:attempted-recon; sid:200004028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mountcreative.net",nocase; classtype:attempted-recon; sid:200004029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"movilbetabcp.com",nocase; classtype:attempted-recon; sid:200004030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moy.oo.jp.youhua8.shop",nocase; classtype:attempted-recon; sid:200004031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mozart-transits.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mp3cut2342win.ru",nocase; classtype:attempted-recon; sid:200004033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mpaypal.cf",nocase; classtype:attempted-recon; sid:200004034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mq.gl",nocase; classtype:attempted-recon; sid:200004035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mqu90adytn7.typeform.com",nocase; classtype:attempted-recon; sid:200004036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mrbeanz.shop",nocase; classtype:attempted-recon; sid:200004037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mrketguru.com",nocase; classtype:attempted-recon; sid:200004038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msc-doelsach.at",nocase; classtype:attempted-recon; sid:200004039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msmetdcagra.in",nocase; classtype:attempted-recon; sid:200004040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msnserviceverifivation.wordpress.com",nocase; classtype:attempted-recon; sid:200004041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msofficemessagescenter-1.mfs.gg",nocase; classtype:attempted-recon; sid:200004042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msofficesystems.mfs.gg",nocase; classtype:attempted-recon; sid:200004043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtngifts2021.blogspot.com",nocase; classtype:attempted-recon; sid:200004044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtpo.pages.dev",nocase; classtype:attempted-recon; sid:200004045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtsn1kotabekasi.sch.id",nocase; classtype:attempted-recon; sid:200004046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mudraloans.biz",nocase; classtype:attempted-recon; sid:200004047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muleshoe-eng.com",nocase; classtype:attempted-recon; sid:200004048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multimeios.com.br",nocase; classtype:attempted-recon; sid:200004049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multirbnacion.com",nocase; classtype:attempted-recon; sid:200004050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multiserviciosfibnc.com",nocase; classtype:attempted-recon; sid:200004051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicbee1.zaarmall.com",nocase; classtype:attempted-recon; sid:200004052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200004053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicisit.de",nocase; classtype:attempted-recon; sid:200004054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musing-blackburn.109-71-253-24.plesk.page",nocase; classtype:attempted-recon; sid:200004055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mvmsgak.cn",nocase; classtype:attempted-recon; sid:200004056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mw2hbg7ev0a.typeform.com",nocase; classtype:attempted-recon; sid:200004057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mxrr.com",nocase; classtype:attempted-recon; sid:200004058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-bithumb.web.app",nocase; classtype:attempted-recon; sid:200004059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-business-100065.square.site",nocase; classtype:attempted-recon; sid:200004060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-business-101819-108675.square.site",nocase; classtype:attempted-recon; sid:200004061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-business-103951-100795.square.site",nocase; classtype:attempted-recon; sid:200004062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-business-105237-103152.square.site",nocase; classtype:attempted-recon; sid:200004063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-business-108685.square.site",nocase; classtype:attempted-recon; sid:200004064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-da4a.ru",nocase; classtype:attempted-recon; sid:200004065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-devices-halifax.com",nocase; classtype:attempted-recon; sid:200004066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-etutor.in",nocase; classtype:attempted-recon; sid:200004067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-exodus-wwallet.yahoosites.com",nocase; classtype:attempted-recon; sid:200004068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-gmail.ir",nocase; classtype:attempted-recon; sid:200004069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-secure-portal.ml",nocase; classtype:attempted-recon; sid:200004070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-secure-portal.tk",nocase; classtype:attempted-recon; sid:200004071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-site219.yolasite.com",nocase; classtype:attempted-recon; sid:200004072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-updated-status.com",nocase; classtype:attempted-recon; sid:200004073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.nativeforms.com",nocase; classtype:attempted-recon; sid:200004074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.softbank.flankli.com",nocase; classtype:attempted-recon; sid:200004075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.softbank.ztstp.bar",nocase; classtype:attempted-recon; sid:200004076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.texter.pk",nocase; classtype:attempted-recon; sid:200004077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my2ktop.company.site",nocase; classtype:attempted-recon; sid:200004078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my2ktop.ecwid.com",nocase; classtype:attempted-recon; sid:200004079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myauthorz.com",nocase; classtype:attempted-recon; sid:200004080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybank.toc.com.ec",nocase; classtype:attempted-recon; sid:200004081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybngdekontuo.my-vgh.org",nocase; classtype:attempted-recon; sid:200004082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybpos.net",nocase; classtype:attempted-recon; sid:200004083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mycoerver.es",nocase; classtype:attempted-recon; sid:200004084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myedd-profile.verifyidentity.workers.dev",nocase; classtype:attempted-recon; sid:200004085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myee-billing-info.com",nocase; classtype:attempted-recon; sid:200004086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myee-billprocess.com",nocase; classtype:attempted-recon; sid:200004087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myeeyouree.com",nocase; classtype:attempted-recon; sid:200004088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myetherwallete.top",nocase; classtype:attempted-recon; sid:200004089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myetherwollot.com",nocase; classtype:attempted-recon; sid:200004090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myexoduswallet.wordpress.com",nocase; classtype:attempted-recon; sid:200004091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myfoodyourplate.com",nocase; classtype:attempted-recon; sid:200004092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myhealthinsquotes.com",nocase; classtype:attempted-recon; sid:200004093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myhermes-redeliveryhelp.com",nocase; classtype:attempted-recon; sid:200004094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myinfo.f5b2g.cn",nocase; classtype:attempted-recon; sid:200004095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjac.vevivb.com",nocase; classtype:attempted-recon; sid:200004096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjac.vivcde.com",nocase; classtype:attempted-recon; sid:200004097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb-2dfgyh.xietuan.net",nocase; classtype:attempted-recon; sid:200004098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcc.vevivb.com",nocase; classtype:attempted-recon; sid:200004099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcd.vevivb.com",nocase; classtype:attempted-recon; sid:200004100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcd.vivcde.com",nocase; classtype:attempted-recon; sid:200004101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjeb.jaced.top",nocase; classtype:attempted-recon; sid:200004102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjeb.jdesb.top",nocase; classtype:attempted-recon; sid:200004103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjeb.jnesb.top",nocase; classtype:attempted-recon; sid:200004104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjicd.vevivb.com",nocase; classtype:attempted-recon; sid:200004105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjd.vevivb.com",nocase; classtype:attempted-recon; sid:200004106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjd.vivcde.com",nocase; classtype:attempted-recon; sid:200004107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjob.jaced.top",nocase; classtype:attempted-recon; sid:200004108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjob.jdesb.top",nocase; classtype:attempted-recon; sid:200004109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjob.jnesb.top",nocase; classtype:attempted-recon; sid:200004110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjjob.jsend.top",nocase; classtype:attempted-recon; sid:200004111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjobassists.com",nocase; classtype:attempted-recon; sid:200004112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mykonos.cl",nocase; classtype:attempted-recon; sid:200004113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mylovejar.com",nocase; classtype:attempted-recon; sid:200004114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymentalhealthday.org",nocase; classtype:attempted-recon; sid:200004115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymweb-owner.at.ua",nocase; classtype:attempted-recon; sid:200004116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-auth.com",nocase; classtype:attempted-recon; sid:200004117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-billing-error28.com",nocase; classtype:attempted-recon; sid:200004118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-billing-error83.com",nocase; classtype:attempted-recon; sid:200004119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myqatar.com",nocase; classtype:attempted-recon; sid:200004120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myqli.com",nocase; classtype:attempted-recon; sid:200004121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myrg.bullionbank.life",nocase; classtype:attempted-recon; sid:200004122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myselogerpro.messages19027.com",nocase; classtype:attempted-recon; sid:200004123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myshedbuilder.com",nocase; classtype:attempted-recon; sid:200004124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysites.infinityfreeapp.com",nocase; classtype:attempted-recon; sid:200004125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysoulaura.com",nocase; classtype:attempted-recon; sid:200004126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mystrongbodysystem.com",nocase; classtype:attempted-recon; sid:200004127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myswisscomonline.net",nocase; classtype:attempted-recon; sid:200004128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myupdates-mynetflix.com",nocase; classtype:attempted-recon; sid:200004129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mzwy2.csb.app",nocase; classtype:attempted-recon; sid:200004130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n-naoko-0319.github.io",nocase; classtype:attempted-recon; sid:200004131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n26-particuluar-n26-personal-own.boxofbusinessblogs.com",nocase; classtype:attempted-recon; sid:200004132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n4r7u.app.link",nocase; classtype:attempted-recon; sid:200004133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n6623a052sk.typeform.com",nocase; classtype:attempted-recon; sid:200004134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n66744rp5er.typeform.com",nocase; classtype:attempted-recon; sid:200004135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n7orton.com",nocase; classtype:attempted-recon; sid:200004136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n9qyb.csb.app",nocase; classtype:attempted-recon; sid:200004137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"na-amazon-creturns.com",nocase; classtype:attempted-recon; sid:200004138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab-alert.mobi",nocase; classtype:attempted-recon; sid:200004139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab-www.303.si",nocase; classtype:attempted-recon; sid:200004140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab.maptq.com",nocase; classtype:attempted-recon; sid:200004141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.com",nocase; classtype:attempted-recon; sid:200004142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.kr",nocase; classtype:attempted-recon; sid:200004143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nacionalbc-cfir.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"najboljeuslugezavas.betterservicesforyou.com",nocase; classtype:attempted-recon; sid:200004145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nakheelmall.in",nocase; classtype:attempted-recon; sid:200004146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nanairan.com",nocase; classtype:attempted-recon; sid:200004147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"naranja-users.auth0.com",nocase; classtype:attempted-recon; sid:200004148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narrativesummit.org",nocase; classtype:attempted-recon; sid:200004149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natdo.cloudns.ph",nocase; classtype:attempted-recon; sid:200004150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"naturayog.in",nocase; classtype:attempted-recon; sid:200004151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.nwolb-device-login.com",nocase; classtype:attempted-recon; sid:200004152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.nwolb-login-auth.com",nocase; classtype:attempted-recon; sid:200004153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secure-auth-personal-device.com",nocase; classtype:attempted-recon; sid:200004154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-online-verify.com",nocase; classtype:attempted-recon; sid:200004155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-personal-verify.com",nocase; classtype:attempted-recon; sid:200004156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nav.vn",nocase; classtype:attempted-recon; sid:200004157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"navigatorthailand.com",nocase; classtype:attempted-recon; sid:200004158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nayameehomes.com",nocase; classtype:attempted-recon; sid:200004159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nbdtrade.com",nocase; classtype:attempted-recon; sid:200004160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nbhomecenterarg.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncaweagricol.byethost33.com",nocase; classtype:attempted-recon; sid:200004162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncservices.co.in",nocase; classtype:attempted-recon; sid:200004163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ne7vwmh61fk.typeform.com",nocase; classtype:attempted-recon; sid:200004164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neberi-online.preview-domain.com",nocase; classtype:attempted-recon; sid:200004165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nebojsega.com",nocase; classtype:attempted-recon; sid:200004166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"necessitymag.com",nocase; classtype:attempted-recon; sid:200004167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbank.demdex.net",nocase; classtype:attempted-recon; sid:200004168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbankqa.flowblocks.com",nocase; classtype:attempted-recon; sid:200004169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedirien.online",nocase; classtype:attempted-recon; sid:200004170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"needupdateto.toonlineamazoncardpresence.work",nocase; classtype:attempted-recon; sid:200004171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neeget-bkpfre28.duckdns.org",nocase; classtype:attempted-recon; sid:200004172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"negociebra.com.br",nocase; classtype:attempted-recon; sid:200004173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nelsonjustus.com.br",nocase; classtype:attempted-recon; sid:200004174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neltfxix.blogspot.com",nocase; classtype:attempted-recon; sid:200004175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nemetschek-hr-benefits.com",nocase; classtype:attempted-recon; sid:200004176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neptuneinnovations.com",nocase; classtype:attempted-recon; sid:200004177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nero.egybest.site",nocase; classtype:attempted-recon; sid:200004178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"net.logowanie-bezpieczna-online.com",nocase; classtype:attempted-recon; sid:200004179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netciti.id",nocase; classtype:attempted-recon; sid:200004180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netfilx.com.zonefivestudio.com",nocase; classtype:attempted-recon; sid:200004181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-com.com",nocase; classtype:attempted-recon; sid:200004182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-fr-fr-navlink-connexion.trans-mea.com",nocase; classtype:attempted-recon; sid:200004183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix.sourceaudio.com",nocase; classtype:attempted-recon; sid:200004184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflixloa.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200004185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflixloginhelp.com",nocase; classtype:attempted-recon; sid:200004186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netgate-store.com",nocase; classtype:attempted-recon; sid:200004187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netlana.com",nocase; classtype:attempted-recon; sid:200004188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netmas.com.mx",nocase; classtype:attempted-recon; sid:200004189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netmovies.duckdns.org",nocase; classtype:attempted-recon; sid:200004190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netprogress.net",nocase; classtype:attempted-recon; sid:200004191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netsantanderuru0.byethost31.com",nocase; classtype:attempted-recon; sid:200004192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netservice-upd.tumblr.com",nocase; classtype:attempted-recon; sid:200004193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netttxnet.byethost3.com",nocase; classtype:attempted-recon; sid:200004194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netw0rksolutions.web.app",nocase; classtype:attempted-recon; sid:200004195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"network.innovatedm.com",nocase; classtype:attempted-recon; sid:200004196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neversencommun.fr",nocase; classtype:attempted-recon; sid:200004197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-control-pamis.com",nocase; classtype:attempted-recon; sid:200004198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-devicehelp.com",nocase; classtype:attempted-recon; sid:200004199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-joinregrup28.duckdns.org",nocase; classtype:attempted-recon; sid:200004200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-payee-lloyds.com",nocase; classtype:attempted-recon; sid:200004201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new.29studios.com",nocase; classtype:attempted-recon; sid:200004202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newbkp-xjoine6.duckdns.org",nocase; classtype:attempted-recon; sid:200004203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newboi365onlineupdate.com",nocase; classtype:attempted-recon; sid:200004204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newcapital-compounds.com",nocase; classtype:attempted-recon; sid:200004205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newereportdata.sgp1.digitaloceanspaces.com",nocase; classtype:attempted-recon; sid:200004206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newhometulsa.cf",nocase; classtype:attempted-recon; sid:200004207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newlien.site44.com",nocase; classtype:attempted-recon; sid:200004208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newnanplazapawnshop.com",nocase; classtype:attempted-recon; sid:200004209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newonline-payee-restricted.com",nocase; classtype:attempted-recon; sid:200004210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newonline-restrict-payee.com",nocase; classtype:attempted-recon; sid:200004211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newrydramafestival.co.uk",nocase; classtype:attempted-recon; sid:200004212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; classtype:attempted-recon; sid:200004213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsletter.pagueonlinebra.com.br",nocase; classtype:attempted-recon; sid:200004214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsonghannover.org",nocase; classtype:attempted-recon; sid:200004215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newupdateppl.blogspot.com",nocase; classtype:attempted-recon; sid:200004216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nexe-meirugarl.servebeer.com",nocase; classtype:attempted-recon; sid:200004217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nextecwebdesign.com",nocase; classtype:attempted-recon; sid:200004218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhfactor.com",nocase; classtype:attempted-recon; sid:200004219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhs.auth-covid-pass.com",nocase; classtype:attempted-recon; sid:200004220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ni212065-1.web02.nitrado.hosting",nocase; classtype:attempted-recon; sid:200004221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"niadabuyherepayhere.com",nocase; classtype:attempted-recon; sid:200004222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"niagarapower.com",nocase; classtype:attempted-recon; sid:200004223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nicacioimobiliaria.com.br",nocase; classtype:attempted-recon; sid:200004224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nichetreasure.com",nocase; classtype:attempted-recon; sid:200004225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nicolasmezher.com",nocase; classtype:attempted-recon; sid:200004226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihongospeechtrainer.com",nocase; classtype:attempted-recon; sid:200004227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nikomac.main.jp",nocase; classtype:attempted-recon; sid:200004228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nipunpharmaskill.com",nocase; classtype:attempted-recon; sid:200004229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nirbhyatv.com",nocase; classtype:attempted-recon; sid:200004230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nissinsb.com",nocase; classtype:attempted-recon; sid:200004231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nixschool.com",nocase; classtype:attempted-recon; sid:200004232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nizotchauffage.bilty.be",nocase; classtype:attempted-recon; sid:200004233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"njolfs.hyperphp.com",nocase; classtype:attempted-recon; sid:200004234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"njxzhf.ml",nocase; classtype:attempted-recon; sid:200004235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nkqeypygwkuxwetmjbdyftrzqmjnni.22web.org",nocase; classtype:attempted-recon; sid:200004236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nl-privateserver.eu",nocase; classtype:attempted-recon; sid:200004237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nlmcilhagger.btinternet.tercumandan.com",nocase; classtype:attempted-recon; sid:200004238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noandy.cn",nocase; classtype:attempted-recon; sid:200004239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noisri.com",nocase; classtype:attempted-recon; sid:200004240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noisy-glitter-1827.workupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200004241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nomehold-gricco3.byethost7.com",nocase; classtype:attempted-recon; sid:200004242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nonstop-ks.com",nocase; classtype:attempted-recon; sid:200004243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noorpk.com",nocase; classtype:attempted-recon; sid:200004244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noqykbj.cn",nocase; classtype:attempted-recon; sid:200004245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"normativa-sicurezza-verifica.app.sicurty-login.com",nocase; classtype:attempted-recon; sid:200004246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notariagalvez.com",nocase; classtype:attempted-recon; sid:200004247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notendur.hi.is",nocase; classtype:attempted-recon; sid:200004248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notesfromnorthwest.pl",nocase; classtype:attempted-recon; sid:200004249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noticia.link",nocase; classtype:attempted-recon; sid:200004250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacioneslv.hostfree.pw",nocase; classtype:attempted-recon; sid:200004251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv.hostfree.pw",nocase; classtype:attempted-recon; sid:200004252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv3.hostfree.pw",nocase; classtype:attempted-recon; sid:200004253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv8.hostfree.pw",nocase; classtype:attempted-recon; sid:200004254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-fb.secure-pages.workers.dev",nocase; classtype:attempted-recon; sid:200004255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-orange6.yolasite.com",nocase; classtype:attempted-recon; sid:200004256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-vocale-ecoute.freeweb.pk",nocase; classtype:attempted-recon; sid:200004257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-2am3335o6s.tv1space.az",nocase; classtype:attempted-recon; sid:200004258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-i0mfyejbpj.tv1space.az",nocase; classtype:attempted-recon; sid:200004259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-j8tjsdr70v.tv1space.az",nocase; classtype:attempted-recon; sid:200004260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-kryox10249.tv1space.az",nocase; classtype:attempted-recon; sid:200004261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nour-ala-nour.com",nocase; classtype:attempted-recon; sid:200004262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"novemberoger.weebly.com",nocase; classtype:attempted-recon; sid:200004263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nowupdate.toonlineamazoncardpresence.buzz",nocase; classtype:attempted-recon; sid:200004264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nowupdate.toonlineamazonpresence.xyz",nocase; classtype:attempted-recon; sid:200004265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nozed-uname.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nrgagencies.com",nocase; classtype:attempted-recon; sid:200004267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ns3pssionntngoal.app.link",nocase; classtype:attempted-recon; sid:200004268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nsaclaim.com",nocase; classtype:attempted-recon; sid:200004269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nslg8.codesandbox.io",nocase; classtype:attempted-recon; sid:200004270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nsr66g7.cn",nocase; classtype:attempted-recon; sid:200004271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nttdocorno-login.emnlco.cn",nocase; classtype:attempted-recon; sid:200004272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nttdocorno-login.gvbh5e2.cn",nocase; classtype:attempted-recon; sid:200004273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nttdocorno-login.vwnstd.cn",nocase; classtype:attempted-recon; sid:200004274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nttdocorno-login.vyirqx.cn",nocase; classtype:attempted-recon; sid:200004275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nueva-acropolis.cl",nocase; classtype:attempted-recon; sid:200004276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuewa-hwa.oracleindustry.com",nocase; classtype:attempted-recon; sid:200004277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuezlincalp.hostkda.com",nocase; classtype:attempted-recon; sid:200004278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nunaproducciones.com",nocase; classtype:attempted-recon; sid:200004279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuovesicurezzeonline.com",nocase; classtype:attempted-recon; sid:200004280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nutralashserum.com",nocase; classtype:attempted-recon; sid:200004281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuu1.com",nocase; classtype:attempted-recon; sid:200004282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuvuneu.com",nocase; classtype:attempted-recon; sid:200004283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nv.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200004284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nw-securedfailure.com",nocase; classtype:attempted-recon; sid:200004285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwolbderegisterdevice-access.com",nocase; classtype:attempted-recon; sid:200004286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecure-iproceed-icancel.com",nocase; classtype:attempted-recon; sid:200004287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecure-newdevice-iproceed.com",nocase; classtype:attempted-recon; sid:200004288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecurity-setdevice-icancel.com",nocase; classtype:attempted-recon; sid:200004289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ny.piratebayproxy.co",nocase; classtype:attempted-recon; sid:200004290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyehkan.co.vu",nocase; classtype:attempted-recon; sid:200004291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyeline.com",nocase; classtype:attempted-recon; sid:200004292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyhet.cc",nocase; classtype:attempted-recon; sid:200004293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-authbill-secure.com",nocase; classtype:attempted-recon; sid:200004294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-failure-billing-update.com",nocase; classtype:attempted-recon; sid:200004295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-processbilling-update.com",nocase; classtype:attempted-recon; sid:200004296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-securebilling-update.com",nocase; classtype:attempted-recon; sid:200004297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-service-account.com",nocase; classtype:attempted-recon; sid:200004298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-updatebillingvia.com",nocase; classtype:attempted-recon; sid:200004299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2.customer-27301.com",nocase; classtype:attempted-recon; sid:200004300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2billingauth-update.com",nocase; classtype:attempted-recon; sid:200004301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2uk-payeeinfo.com",nocase; classtype:attempted-recon; sid:200004302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o365.yourcbsm.work",nocase; classtype:attempted-recon; sid:200004303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o365microsoftonline.com",nocase; classtype:attempted-recon; sid:200004304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o365supports.com",nocase; classtype:attempted-recon; sid:200004305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o5cpm.skipdns.link",nocase; classtype:attempted-recon; sid:200004306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o790j2.cn",nocase; classtype:attempted-recon; sid:200004307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oa5.a0001.net",nocase; classtype:attempted-recon; sid:200004308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ob-web-portalid.com",nocase; classtype:attempted-recon; sid:200004309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oberpiskoihof.it",nocase; classtype:attempted-recon; sid:200004310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objective-merkle.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200004311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objectstorage.ca-montreal-1.oraclecloud.com",nocase; classtype:attempted-recon; sid:200004312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"observatoriodeourofino.com.br",nocase; classtype:attempted-recon; sid:200004313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"observatoriodoalgarve.com",nocase; classtype:attempted-recon; sid:200004314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ocaque-domen.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oceantires.com",nocase; classtype:attempted-recon; sid:200004316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ocioturismogalicia.com",nocase; classtype:attempted-recon; sid:200004317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"odiasamaj.net",nocase; classtype:attempted-recon; sid:200004318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"odinluxury.com",nocase; classtype:attempted-recon; sid:200004319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"of7dh0jxy4s.typeform.com",nocase; classtype:attempted-recon; sid:200004320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ofcard8.cn",nocase; classtype:attempted-recon; sid:200004321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offerscorner.xyz",nocase; classtype:attempted-recon; sid:200004322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offfli.cloudns.ph",nocase; classtype:attempted-recon; sid:200004323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic365.online",nocase; classtype:attempted-recon; sid:200004324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic3887688.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200004325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic4046217.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200004326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office-updateinfo.net",nocase; classtype:attempted-recon; sid:200004327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office.community-foundation.work",nocase; classtype:attempted-recon; sid:200004328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office365.apps.maxsolutions.com.au",nocase; classtype:attempted-recon; sid:200004329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officeee.bubbleapps.io",nocase; classtype:attempted-recon; sid:200004330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officetecheg.com",nocase; classtype:attempted-recon; sid:200004331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialevent.way.live",nocase; classtype:attempted-recon; sid:200004332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialliker.co",nocase; classtype:attempted-recon; sid:200004333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialwalletconnect.dev",nocase; classtype:attempted-recon; sid:200004334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialy2k.com",nocase; classtype:attempted-recon; sid:200004335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ofmvp.com",nocase; classtype:attempted-recon; sid:200004336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ogrodywlochy.pl",nocase; classtype:attempted-recon; sid:200004337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ogz6d.codesandbox.io",nocase; classtype:attempted-recon; sid:200004338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oh-unemployment-ohio-gov.com",nocase; classtype:attempted-recon; sid:200004339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oi58904x.yolasite.com",nocase; classtype:attempted-recon; sid:200004340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oillamp.zikiso.jp",nocase; classtype:attempted-recon; sid:200004341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oimos.com.mx",nocase; classtype:attempted-recon; sid:200004342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojnw.app.link",nocase; classtype:attempted-recon; sid:200004343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojs.budimulia.ac.id",nocase; classtype:attempted-recon; sid:200004344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ok202088.com",nocase; classtype:attempted-recon; sid:200004345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okblrsp.wmsistseg.com.br",nocase; classtype:attempted-recon; sid:200004346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okepviral27.duckdns.org",nocase; classtype:attempted-recon; sid:200004347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okwok.co.kr",nocase; classtype:attempted-recon; sid:200004348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old-grass-c912.dhldeliverylogintoconfirm.workers.dev",nocase; classtype:attempted-recon; sid:200004349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old.prunescape.com.au",nocase; classtype:attempted-recon; sid:200004350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldschool-runescape-bondrewards.com",nocase; classtype:attempted-recon; sid:200004351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldschool-runescape-securedbonds.com",nocase; classtype:attempted-recon; sid:200004352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olidooo.waca.tw",nocase; classtype:attempted-recon; sid:200004353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olittbakeryv2-71.olitt.net",nocase; classtype:attempted-recon; sid:200004354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-casa.com",nocase; classtype:attempted-recon; sid:200004355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-group.com",nocase; classtype:attempted-recon; sid:200004356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl-konto-ref.com",nocase; classtype:attempted-recon; sid:200004357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.125481.space",nocase; classtype:attempted-recon; sid:200004358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.229004.space",nocase; classtype:attempted-recon; sid:200004359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.2671923.space",nocase; classtype:attempted-recon; sid:200004360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.285629.pw",nocase; classtype:attempted-recon; sid:200004361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.385912.space",nocase; classtype:attempted-recon; sid:200004362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.dostawa.name",nocase; classtype:attempted-recon; sid:200004363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-id222333.icu",nocase; classtype:attempted-recon; sid:200004364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-id319249.icu",nocase; classtype:attempted-recon; sid:200004365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-id741566512.net",nocase; classtype:attempted-recon; sid:200004366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.rwpay.ru",nocase; classtype:attempted-recon; sid:200004367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omesqiwines.de",nocase; classtype:attempted-recon; sid:200004368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omshad-links.com",nocase; classtype:attempted-recon; sid:200004369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-linecaso326.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-linecaso3298.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-me-ro.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onboard-logid-checker.com",nocase; classtype:attempted-recon; sid:200004373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oncopharma-ae.com",nocase; classtype:attempted-recon; sid:200004374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneaim.lu",nocase; classtype:attempted-recon; sid:200004375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onecreator.info",nocase; classtype:attempted-recon; sid:200004376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onee-a0488.web.app",nocase; classtype:attempted-recon; sid:200004377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onemedic.com.mx",nocase; classtype:attempted-recon; sid:200004378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-19cd8.web.app",nocase; classtype:attempted-recon; sid:200004379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-a38ef.web.app",nocase; classtype:attempted-recon; sid:200004380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ongocasavus.creatorlink.net",nocase; classtype:attempted-recon; sid:200004381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auth-doc-trippumbach.cf",nocase; classtype:attempted-recon; sid:200004382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-bank-spk.com",nocase; classtype:attempted-recon; sid:200004383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-doc-madisonpointecc.cf",nocase; classtype:attempted-recon; sid:200004384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-omgeving-lcs.zap829280-1.plesk12.zap-webspace.com",nocase; classtype:attempted-recon; sid:200004385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-veiligheid.net",nocase; classtype:attempted-recon; sid:200004386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.natwest-personal.com",nocase; classtype:attempted-recon; sid:200004387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.natwest-supportcentre.com",nocase; classtype:attempted-recon; sid:200004388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online2banking.byethost6.com",nocase; classtype:attempted-recon; sid:200004389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinebneutuedwybjrgwrezyqqvhatcvbuubebnonline.66ghz.com",nocase; classtype:attempted-recon; sid:200004390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineduplicatebills.com",nocase; classtype:attempted-recon; sid:200004391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepagebd44026.weebly.com",nocase; classtype:attempted-recon; sid:200004392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepayee-restricted-service.com",nocase; classtype:attempted-recon; sid:200004393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineprint.cufapparel.cf",nocase; classtype:attempted-recon; sid:200004394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromerica.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromerica5.byethost8.com",nocase; classtype:attempted-recon; sid:200004396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromericac.byethost3.com",nocase; classtype:attempted-recon; sid:200004397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromericas.byethost7.com",nocase; classtype:attempted-recon; sid:200004398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinereader.judokamarket.tk",nocase; classtype:attempted-recon; sid:200004399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineremanager.com",nocase; classtype:attempted-recon; sid:200004400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineroisupportupdate.com",nocase; classtype:attempted-recon; sid:200004401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinesbi.online",nocase; classtype:attempted-recon; sid:200004402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineserveroffice365.mfs.gg",nocase; classtype:attempted-recon; sid:200004403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinespkwebportal.com",nocase; classtype:attempted-recon; sid:200004404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinesupport32.ddns.net",nocase; classtype:attempted-recon; sid:200004405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinpromerica2.byethost11.com",nocase; classtype:attempted-recon; sid:200004406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onsparks-dab.blogspot.com",nocase; classtype:attempted-recon; sid:200004407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ooxvocalor.yolasite.com",nocase; classtype:attempted-recon; sid:200004408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opajasfasfasi.pages.dev",nocase; classtype:attempted-recon; sid:200004409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"open24.ie-news.irish",nocase; classtype:attempted-recon; sid:200004410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"openmessageriespacemms.ukit.me",nocase; classtype:attempted-recon; sid:200004411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"openseapro.io",nocase; classtype:attempted-recon; sid:200004412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opensseae.site",nocase; classtype:attempted-recon; sid:200004413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opentorue.byethost7.com",nocase; classtype:attempted-recon; sid:200004414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"operacaocaixa.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200004415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"operacionmultired1bn-web.com",nocase; classtype:attempted-recon; sid:200004416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opfgmdm.creatorlink.net",nocase; classtype:attempted-recon; sid:200004417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opjkk.creatorlink.net",nocase; classtype:attempted-recon; sid:200004418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oplensea.io",nocase; classtype:attempted-recon; sid:200004419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opsidposqidpoqsidpoiqspodiqsopdipqsd.blogspot.com",nocase; classtype:attempted-recon; sid:200004420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optika-anda.hr",nocase; classtype:attempted-recon; sid:200004421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-au.blogspot.com",nocase; classtype:attempted-recon; sid:200004422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-com-au.blogspot.com",nocase; classtype:attempted-recon; sid:200004423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; classtype:attempted-recon; sid:200004424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oqxbnfeq.cn",nocase; classtype:attempted-recon; sid:200004425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ora-n.yolasite.com",nocase; classtype:attempted-recon; sid:200004426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orabu.it",nocase; classtype:attempted-recon; sid:200004427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-assistance.fr",nocase; classtype:attempted-recon; sid:200004428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-dcr.fr",nocase; classtype:attempted-recon; sid:200004429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-mobile16.wixsite.com",nocase; classtype:attempted-recon; sid:200004430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-offre.mobile-forfait.client.travelforever.co.uk",nocase; classtype:attempted-recon; sid:200004431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-security.cloud.coreoz.com",nocase; classtype:attempted-recon; sid:200004432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange.iobeya.com",nocase; classtype:attempted-recon; sid:200004433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange624.yolasite.com",nocase; classtype:attempted-recon; sid:200004434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangeclient.quest",nocase; classtype:attempted-recon; sid:200004435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangeconnectweb.contactin.bio",nocase; classtype:attempted-recon; sid:200004436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangefrportail5.yolasite.com",nocase; classtype:attempted-recon; sid:200004437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemails0.moonfruit.com",nocase; classtype:attempted-recon; sid:200004438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemessagerie.icon.io",nocase; classtype:attempted-recon; sid:200004439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemiseajour.hostfree.pw",nocase; classtype:attempted-recon; sid:200004440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangewold.contactin.bio",nocase; classtype:attempted-recon; sid:200004441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orbrsp.lyhlyh.xyz",nocase; classtype:attempted-recon; sid:200004442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orcapm.com",nocase; classtype:attempted-recon; sid:200004443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ordenesticccc.com",nocase; classtype:attempted-recon; sid:200004444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"org-nr.yolasite.com",nocase; classtype:attempted-recon; sid:200004445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"organicreviews.net",nocase; classtype:attempted-recon; sid:200004446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalcomics.fr",nocase; classtype:attempted-recon; sid:200004447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalfilm.se",nocase; classtype:attempted-recon; sid:200004448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlandoareavacations.orlandoareavacation.com",nocase; classtype:attempted-recon; sid:200004449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen-group.biz",nocase; classtype:attempted-recon; sid:200004450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen-group.us",nocase; classtype:attempted-recon; sid:200004451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen.hotchili.pl",nocase; classtype:attempted-recon; sid:200004452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlengroup.biz",nocase; classtype:attempted-recon; sid:200004453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlengroup.us",nocase; classtype:attempted-recon; sid:200004454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlenoil-la.com",nocase; classtype:attempted-recon; sid:200004455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlenprofit.us",nocase; classtype:attempted-recon; sid:200004456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ormantencs112.odoo.com",nocase; classtype:attempted-recon; sid:200004457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ormlrh.xyz",nocase; classtype:attempted-recon; sid:200004458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orquestaloshispanos.com",nocase; classtype:attempted-recon; sid:200004459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ortonder.freecluster.eu",nocase; classtype:attempted-recon; sid:200004460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oskysh.cn",nocase; classtype:attempted-recon; sid:200004461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"osmaslo.ru",nocase; classtype:attempted-recon; sid:200004462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto-h229.net",nocase; classtype:attempted-recon; sid:200004463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto3452.com",nocase; classtype:attempted-recon; sid:200004464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oudczfbniitcqdsrmaapdztwqo-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourgarden.us",nocase; classtype:attempted-recon; sid:200004466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourlovmess.wordpress.com",nocase; classtype:attempted-recon; sid:200004467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-mailer.com",nocase; classtype:attempted-recon; sid:200004468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-microsoftlogin98uqwuuw8as.questionpro.com",nocase; classtype:attempted-recon; sid:200004469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook.b-cdn.net",nocase; classtype:attempted-recon; sid:200004470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook12861.activehosted.com",nocase; classtype:attempted-recon; sid:200004471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook1541489.webcindario.com",nocase; classtype:attempted-recon; sid:200004472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookcom119.yolasite.com",nocase; classtype:attempted-recon; sid:200004473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookhelpdesk.activehosted.com",nocase; classtype:attempted-recon; sid:200004474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookwebupdate850.wixsite.com",nocase; classtype:attempted-recon; sid:200004475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ov74x.codesandbox.io",nocase; classtype:attempted-recon; sid:200004476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"overelaborated.servepics.com",nocase; classtype:attempted-recon; sid:200004477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ow.yestojudge.cn",nocase; classtype:attempted-recon; sid:200004478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owaauthmail.sitey.me",nocase; classtype:attempted-recon; sid:200004479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owablu84349439434.web.app",nocase; classtype:attempted-recon; sid:200004480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owambewww.com",nocase; classtype:attempted-recon; sid:200004481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owaupgradeservice3.myfreesites.net",nocase; classtype:attempted-recon; sid:200004482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owiagbn.wmsistseg.com.br",nocase; classtype:attempted-recon; sid:200004483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oxo.zobanzi.net",nocase; classtype:attempted-recon; sid:200004484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oxskincare.com",nocase; classtype:attempted-recon; sid:200004485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ozxl0q.webwave.dev",nocase; classtype:attempted-recon; sid:200004487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p-pancakeswap.com",nocase; classtype:attempted-recon; sid:200004488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p.wpage.cc",nocase; classtype:attempted-recon; sid:200004489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1.pagewiz.net",nocase; classtype:attempted-recon; sid:200004490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1c.servleboncoinser.com",nocase; classtype:attempted-recon; sid:200004491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1ch14nga.byethost6.com",nocase; classtype:attempted-recon; sid:200004492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p3i.lp3.ulm.ac.id",nocase; classtype:attempted-recon; sid:200004493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p402s.codesandbox.io",nocase; classtype:attempted-recon; sid:200004494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p84ig.csb.app",nocase; classtype:attempted-recon; sid:200004495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paancaakswaap.digital",nocase; classtype:attempted-recon; sid:200004496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paancacesvip.finance",nocase; classtype:attempted-recon; sid:200004497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paavos.in",nocase; classtype:attempted-recon; sid:200004498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pacakeswap.pancakes.pagedemo.co",nocase; classtype:attempted-recon; sid:200004499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"packlevovd.byethost32.com",nocase; classtype:attempted-recon; sid:200004500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"padetiswed.com",nocase; classtype:attempted-recon; sid:200004501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paenceceswoap-crypto.com",nocase; classtype:attempted-recon; sid:200004502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagecomunityprivacypolicy.co.vu",nocase; classtype:attempted-recon; sid:200004503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-1008200227810541021.pw",nocase; classtype:attempted-recon; sid:200004504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-and-community-service.pp.ua",nocase; classtype:attempted-recon; sid:200004505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-marvelous-project.webflow.io",nocase; classtype:attempted-recon; sid:200004506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-support-office.gq",nocase; classtype:attempted-recon; sid:200004507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages.findmyhome.at",nocase; classtype:attempted-recon; sid:200004508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages.secure-accts.workers.dev",nocase; classtype:attempted-recon; sid:200004509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesbusinnessidentitysafety.co.vu",nocase; classtype:attempted-recon; sid:200004510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesforbussinesidentitysupportlive.co.vu",nocase; classtype:attempted-recon; sid:200004511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesscurityprivasandproblem.co.vu",nocase; classtype:attempted-recon; sid:200004512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagessosialitiidentityservice.co.vu",nocase; classtype:attempted-recon; sid:200004513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagessuupportsystem.co.vu",nocase; classtype:attempted-recon; sid:200004514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagincolm.com",nocase; classtype:attempted-recon; sid:200004515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pago-correos-camino.com",nocase; classtype:attempted-recon; sid:200004516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pahohpver.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paincurephysio.com",nocase; classtype:attempted-recon; sid:200004518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pallkaceswep.finance",nocase; classtype:attempted-recon; sid:200004519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"palmtechy.com",nocase; classtype:attempted-recon; sid:200004520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pamelajenle.com",nocase; classtype:attempted-recon; sid:200004521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panarescwap.finance",nocase; classtype:attempted-recon; sid:200004522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancaekeswap.com",nocase; classtype:attempted-recon; sid:200004523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake.finance.fixswaps.com",nocase; classtype:attempted-recon; sid:200004524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakecurrency.finance",nocase; classtype:attempted-recon; sid:200004525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakepoll-promogive.com",nocase; classtype:attempted-recon; sid:200004526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakes.wap-finance.xyz",nocase; classtype:attempted-recon; sid:200004527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesfinances.info",nocase; classtype:attempted-recon; sid:200004528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakess-swapp.online",nocase; classtype:attempted-recon; sid:200004529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesswapfinance.net",nocase; classtype:attempted-recon; sid:200004530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvvap-invest.com",nocase; classtype:attempted-recon; sid:200004531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvvop-investments.com",nocase; classtype:attempted-recon; sid:200004532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvwap.com",nocase; classtype:attempted-recon; sid:200004533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvwape.finance",nocase; classtype:attempted-recon; sid:200004534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaap.help",nocase; classtype:attempted-recon; sid:200004535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-head.tech",nocase; classtype:attempted-recon; sid:200004536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-larg.tech",nocase; classtype:attempted-recon; sid:200004537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-p.com",nocase; classtype:attempted-recon; sid:200004538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-singl.tech",nocase; classtype:attempted-recon; sid:200004539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-wort.tech",nocase; classtype:attempted-recon; sid:200004540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.co.com",nocase; classtype:attempted-recon; sid:200004541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.acirfouvag.gq",nocase; classtype:attempted-recon; sid:200004542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.adcomtaecomptaletz.tk",nocase; classtype:attempted-recon; sid:200004543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.birthgadi.cf",nocase; classtype:attempted-recon; sid:200004544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.cesshawri.tk",nocase; classtype:attempted-recon; sid:200004545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.change-proceed.in",nocase; classtype:attempted-recon; sid:200004546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.exchange-go.in",nocase; classtype:attempted-recon; sid:200004547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.exchange-trade.in",nocase; classtype:attempted-recon; sid:200004548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.go-proceed.in",nocase; classtype:attempted-recon; sid:200004549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.goswap-tokens.in",nocase; classtype:attempted-recon; sid:200004550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.porazys.ga",nocase; classtype:attempted-recon; sid:200004551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.presestalagpa.cf",nocase; classtype:attempted-recon; sid:200004552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.rehota.tk",nocase; classtype:attempted-recon; sid:200004553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.smart-buy.in",nocase; classtype:attempted-recon; sid:200004554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.swap-trade.in",nocase; classtype:attempted-recon; sid:200004555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.swapgo.in",nocase; classtype:attempted-recon; sid:200004556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.swoptokenx.com",nocase; classtype:attempted-recon; sid:200004557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.therowi.tk",nocase; classtype:attempted-recon; sid:200004558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.tingcita.cf",nocase; classtype:attempted-recon; sid:200004559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.tokens-checkout.in",nocase; classtype:attempted-recon; sid:200004560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.tokens-swap.in",nocase; classtype:attempted-recon; sid:200004561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.trade-proceed.in",nocase; classtype:attempted-recon; sid:200004562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.trade-tokens.in",nocase; classtype:attempted-recon; sid:200004563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.market",nocase; classtype:attempted-recon; sid:200004564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.salsasourcing.com",nocase; classtype:attempted-recon; sid:200004565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.win96.io",nocase; classtype:attempted-recon; sid:200004566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapp.su",nocase; classtype:attempted-recon; sid:200004567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapps.com",nocase; classtype:attempted-recon; sid:200004568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswappshop.blogspot.com",nocase; classtype:attempted-recon; sid:200004569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaps.info",nocase; classtype:attempted-recon; sid:200004570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaps.xyz",nocase; classtype:attempted-recon; sid:200004571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapus.com",nocase; classtype:attempted-recon; sid:200004572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswop-flnance.com",nocase; classtype:attempted-recon; sid:200004573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswop.best",nocase; classtype:attempted-recon; sid:200004574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswqp.com",nocase; classtype:attempted-recon; sid:200004575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswvop.com",nocase; classtype:attempted-recon; sid:200004576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswvoq.com",nocase; classtype:attempted-recon; sid:200004577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakexswap.net",nocase; classtype:attempted-recon; sid:200004578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakkeswap.financial",nocase; classtype:attempted-recon; sid:200004579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakswap.at",nocase; classtype:attempted-recon; sid:200004580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancaleswap.com",nocase; classtype:attempted-recon; sid:200004581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancalteswap.finance",nocase; classtype:attempted-recon; sid:200004582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancekesswep.uk",nocase; classtype:attempted-recon; sid:200004583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panceykswap.com",nocase; classtype:attempted-recon; sid:200004584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panceykswapp.cyou",nocase; classtype:attempted-recon; sid:200004585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panceykswapp.one",nocase; classtype:attempted-recon; sid:200004586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panchamrutherbals.com",nocase; classtype:attempted-recon; sid:200004587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pandaskin.ru.com",nocase; classtype:attempted-recon; sid:200004588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panelweb-4cae2.web.app",nocase; classtype:attempted-recon; sid:200004589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pangolinswap-giveaway.com",nocase; classtype:attempted-recon; sid:200004590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panicakieswap.net",nocase; classtype:attempted-recon; sid:200004591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panicakieswap.org",nocase; classtype:attempted-recon; sid:200004592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pankakesvvap-franchise.com",nocase; classtype:attempted-recon; sid:200004593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pankakesvvop-holding.com",nocase; classtype:attempted-recon; sid:200004594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pankakeswap.ledgity.com",nocase; classtype:attempted-recon; sid:200004595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pankekceswap-finance.com",nocase; classtype:attempted-recon; sid:200004596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panterpro.com",nocase; classtype:attempted-recon; sid:200004597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paqueteseur.info",nocase; classtype:attempted-recon; sid:200004598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parcelsshipment-94b2d9.ingress-erytho.easywp.com",nocase; classtype:attempted-recon; sid:200004599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pardot.assemblecommunities.com",nocase; classtype:attempted-recon; sid:200004600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parkerwayland.com",nocase; classtype:attempted-recon; sid:200004601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parkfans.nl",nocase; classtype:attempted-recon; sid:200004602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parknetweb.com",nocase; classtype:attempted-recon; sid:200004603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parroquiajesucristoredentor.com",nocase; classtype:attempted-recon; sid:200004604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pascal.ddnsking.com",nocase; classtype:attempted-recon; sid:200004605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"passionfruit4576261.brizy.site",nocase; classtype:attempted-recon; sid:200004606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"passproa.byethost7.com",nocase; classtype:attempted-recon; sid:200004607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"password-keep.veriffy-azzount.cloudns.ph",nocase; classtype:attempted-recon; sid:200004608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"password0-veri.jackmainpaswveru.cloudns.ph",nocase; classtype:attempted-recon; sid:200004609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pateltutorials.com",nocase; classtype:attempted-recon; sid:200004610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pathikareps.com",nocase; classtype:attempted-recon; sid:200004611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patient-cell-40f5.updatedlogmylogin.workers.dev",nocase; classtype:attempted-recon; sid:200004612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrickle3.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200004613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paulmitchellforcongress.com",nocase; classtype:attempted-recon; sid:200004614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paws.org.au",nocase; classtype:attempted-recon; sid:200004615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxfu1page.com",nocase; classtype:attempted-recon; sid:200004616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful-api.com.autowritely.com",nocase; classtype:attempted-recon; sid:200004617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful-escrow.com",nocase; classtype:attempted-recon; sid:200004618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful.com.pk",nocase; classtype:attempted-recon; sid:200004619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful.com.pl",nocase; classtype:attempted-recon; sid:200004620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay-sera.web.app",nocase; classtype:attempted-recon; sid:200004621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay.pl-olx.digital",nocase; classtype:attempted-recon; sid:200004622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay16-olx.pl",nocase; classtype:attempted-recon; sid:200004623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay4pictures.com",nocase; classtype:attempted-recon; sid:200004624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payee-my-hali.com",nocase; classtype:attempted-recon; sid:200004625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payee-securityerror.com",nocase; classtype:attempted-recon; sid:200004626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payeenew-hali.com",nocase; classtype:attempted-recon; sid:200004627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payerrorpal.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment.irs.benefit.marypoesia.com",nocase; classtype:attempted-recon; sid:200004629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentfailure-assistant.com",nocase; classtype:attempted-recon; sid:200004630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentnotificationnow.blogspot.com",nocase; classtype:attempted-recon; sid:200004631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-caseid7216.com",nocase; classtype:attempted-recon; sid:200004632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-caseid8723.com",nocase; classtype:attempted-recon; sid:200004633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-customer-service.business.site",nocase; classtype:attempted-recon; sid:200004634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-making.bounceme.net",nocase; classtype:attempted-recon; sid:200004635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-me-alessandra-martini.com",nocase; classtype:attempted-recon; sid:200004636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-merchantloyalty.com",nocase; classtype:attempted-recon; sid:200004637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-myacount.com",nocase; classtype:attempted-recon; sid:200004638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-opladen.be",nocase; classtype:attempted-recon; sid:200004639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-securi.com",nocase; classtype:attempted-recon; sid:200004640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-test.projektumfeld.de",nocase; classtype:attempted-recon; sid:200004641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-ticketid8415.com",nocase; classtype:attempted-recon; sid:200004642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.ca.purchasekindle.com",nocase; classtype:attempted-recon; sid:200004643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.co.uk.useriazi6bqgssb.settingsppup.com",nocase; classtype:attempted-recon; sid:200004644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se",nocase; classtype:attempted-recon; sid:200004645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.update.service.verify.freeget.net",nocase; classtype:attempted-recon; sid:200004646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.yuursayur.id",nocase; classtype:attempted-recon; sid:200004647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalauthsecurity.cloudns.ph",nocase; classtype:attempted-recon; sid:200004648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalforex.co.ke",nocase; classtype:attempted-recon; sid:200004649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypayr.top",nocase; classtype:attempted-recon; sid:200004650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypei.co",nocase; classtype:attempted-recon; sid:200004651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypoy.top",nocase; classtype:attempted-recon; sid:200004652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payqay.top",nocase; classtype:attempted-recon; sid:200004653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payu.okta-emea.com",nocase; classtype:attempted-recon; sid:200004654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbi.unsam.ac.id",nocase; classtype:attempted-recon; sid:200004655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbpro3453file.gb.net",nocase; classtype:attempted-recon; sid:200004656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbrlp.gov.bd",nocase; classtype:attempted-recon; sid:200004657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcbacweblogin.webcindario.com",nocase; classtype:attempted-recon; sid:200004658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcbc-webalert03.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pchnaasdban.byethost33.com",nocase; classtype:attempted-recon; sid:200004660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pchnchabanc.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200004662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-cloud-document.weeblysite.com",nocase; classtype:attempted-recon; sid:200004663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-sharefile-doc.weeblysite.com",nocase; classtype:attempted-recon; sid:200004664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdflogincnvwo.app.link",nocase; classtype:attempted-recon; sid:200004665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdmvietnam.vn",nocase; classtype:attempted-recon; sid:200004666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdp.eue.mybluehost.me",nocase; classtype:attempted-recon; sid:200004667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pearlfilms.com",nocase; classtype:attempted-recon; sid:200004668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pecadotest.interwapp.com",nocase; classtype:attempted-recon; sid:200004669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pelhaf041984.byethost9.com",nocase; classtype:attempted-recon; sid:200004670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pencakecwap.com",nocase; classtype:attempted-recon; sid:200004671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"penneyspc.com",nocase; classtype:attempted-recon; sid:200004672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pensea.cfd",nocase; classtype:attempted-recon; sid:200004673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"penskoprsmssgahjmessa.sfo3.digitaloceanspaces.com",nocase; classtype:attempted-recon; sid:200004674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peppylids.co.uk",nocase; classtype:attempted-recon; sid:200004675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectliker.net",nocase; classtype:attempted-recon; sid:200004676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectlybuilt.ca",nocase; classtype:attempted-recon; sid:200004677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfumesway.rw",nocase; classtype:attempted-recon; sid:200004678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peringatanakunfb2k214.webnode.com",nocase; classtype:attempted-recon; sid:200004679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"personal.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peru.payulatam.com",nocase; classtype:attempted-recon; sid:200004681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peruzonazonasegvra-bnweb29.com",nocase; classtype:attempted-recon; sid:200004682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pet0ewiro930.xyz",nocase; classtype:attempted-recon; sid:200004683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"petesappliancesllc.com",nocase; classtype:attempted-recon; sid:200004684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ph.vexxalife.com",nocase; classtype:attempted-recon; sid:200004685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phantom-beta.com",nocase; classtype:attempted-recon; sid:200004686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phantomwallets.net",nocase; classtype:attempted-recon; sid:200004687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pharmaglobiz.com",nocase; classtype:attempted-recon; sid:200004688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phc56741.wixsite.com",nocase; classtype:attempted-recon; sid:200004689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phillipmill176545.clickfunnels.com",nocase; classtype:attempted-recon; sid:200004690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"philodox.in",nocase; classtype:attempted-recon; sid:200004691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphicocobella.com",nocase; classtype:attempted-recon; sid:200004692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphihotelgroup.com",nocase; classtype:attempted-recon; sid:200004693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phongvuexpress.vn",nocase; classtype:attempted-recon; sid:200004694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phonzworld.com",nocase; classtype:attempted-recon; sid:200004695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photo-wee.com",nocase; classtype:attempted-recon; sid:200004696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photoartstavrinos.com",nocase; classtype:attempted-recon; sid:200004697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photoshopfocus.onlinebuyerstips.com",nocase; classtype:attempted-recon; sid:200004698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phreshphoto.com",nocase; classtype:attempted-recon; sid:200004699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"piandizano.it",nocase; classtype:attempted-recon; sid:200004700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pibs-service.cc",nocase; classtype:attempted-recon; sid:200004701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pibs-service.net",nocase; classtype:attempted-recon; sid:200004702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichiactivate711.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichin-web.ihostfull.com",nocase; classtype:attempted-recon; sid:200004704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincalog00.ihostfull.com",nocase; classtype:attempted-recon; sid:200004705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincha-msj.byethost7.com",nocase; classtype:attempted-recon; sid:200004706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincha.conlinux.net",nocase; classtype:attempted-recon; sid:200004707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaa.com",nocase; classtype:attempted-recon; sid:200004708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchal.byethost24.com",nocase; classtype:attempted-recon; sid:200004709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaonline.byethost6.com",nocase; classtype:attempted-recon; sid:200004710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaq.byethost4.com",nocase; classtype:attempted-recon; sid:200004711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchasdirecu.byethost7.com",nocase; classtype:attempted-recon; sid:200004712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchasss.freecluster.eu",nocase; classtype:attempted-recon; sid:200004713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaweb-ecu.byethost7.com",nocase; classtype:attempted-recon; sid:200004714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchawebline.byethost7.com",nocase; classtype:attempted-recon; sid:200004715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchawebsite.2host.me",nocase; classtype:attempted-recon; sid:200004716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinotificpin1.ihostfull.com",nocase; classtype:attempted-recon; sid:200004717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichnchaaban134.ihostfull.com",nocase; classtype:attempted-recon; sid:200004718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"picnic.industries",nocase; classtype:attempted-recon; sid:200004719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pics.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200004720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"picsurely.com",nocase; classtype:attempted-recon; sid:200004721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pijcjbgy.weebly.com",nocase; classtype:attempted-recon; sid:200004722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikaresailing.com",nocase; classtype:attempted-recon; sid:200004723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikay13.github.io",nocase; classtype:attempted-recon; sid:200004724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pil.nxn.mybluehost.me",nocase; classtype:attempted-recon; sid:200004725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pilotofficial.mfs.gg",nocase; classtype:attempted-recon; sid:200004726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkybeautybar.com",nocase; classtype:attempted-recon; sid:200004727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pioutyutriut.square.site",nocase; classtype:attempted-recon; sid:200004728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pips.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200004729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pixelbenchmarks.com",nocase; classtype:attempted-recon; sid:200004730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pizfirepizzacafe.com",nocase; classtype:attempted-recon; sid:200004731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pkk.depok.go.id",nocase; classtype:attempted-recon; sid:200004732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl-19.ru",nocase; classtype:attempted-recon; sid:200004733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl.pl2021.ru",nocase; classtype:attempted-recon; sid:200004734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl6n07xyxd.cbafisbsc18869ztrcv6qrackel.com",nocase; classtype:attempted-recon; sid:200004735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plain-bird-ee0e.jim-isaac10001.workers.dev",nocase; classtype:attempted-recon; sid:200004736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plain-bush-2ed3.dhlcaredmxcarelogin.workers.dev",nocase; classtype:attempted-recon; sid:200004737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plan-o2-monthlypayments.com",nocase; classtype:attempted-recon; sid:200004738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plantamariaeugenia.com",nocase; classtype:attempted-recon; sid:200004739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasifell44.freecluster.eu",nocase; classtype:attempted-recon; sid:200004740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasticaindia.com",nocase; classtype:attempted-recon; sid:200004741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plataformaeducativa.se.jalisco.gob.mx",nocase; classtype:attempted-recon; sid:200004742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plugmailextraexpiredoldpolicynotificationscenter.pages.dev",nocase; classtype:attempted-recon; sid:200004743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plush.my",nocase; classtype:attempted-recon; sid:200004744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plyl8j.cn",nocase; classtype:attempted-recon; sid:200004745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pm.skillers.pk",nocase; classtype:attempted-recon; sid:200004746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmatsski.mfs.gg",nocase; classtype:attempted-recon; sid:200004747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmbonline.unmuha.ac.id",nocase; classtype:attempted-recon; sid:200004748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmiconnect-my.sharepoint.com",nocase; classtype:attempted-recon; sid:200004749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmtdyow.wmsistseg.com.br",nocase; classtype:attempted-recon; sid:200004750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pn-mandailingnatal.go.id",nocase; classtype:attempted-recon; sid:200004751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pnrmericasnm.byethost22.com",nocase; classtype:attempted-recon; sid:200004752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"po.do",nocase; classtype:attempted-recon; sid:200004753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poc-rewards-program-c2dfc.web.app",nocase; classtype:attempted-recon; sid:200004754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pochtarefund.anticynic.top",nocase; classtype:attempted-recon; sid:200004755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pocketinfotech.com",nocase; classtype:attempted-recon; sid:200004756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-polska.top",nocase; classtype:attempted-recon; sid:200004757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"podpiska-darom.ru",nocase; classtype:attempted-recon; sid:200004758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poincaceswep-funds.com",nocase; classtype:attempted-recon; sid:200004759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poincaceswoep-trade.com",nocase; classtype:attempted-recon; sid:200004760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poincakesvvep-trade.com",nocase; classtype:attempted-recon; sid:200004761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pokajca.web.app",nocase; classtype:attempted-recon; sid:200004762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polen-esquadrias.blogspot.com",nocase; classtype:attempted-recon; sid:200004763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"policlinicabucodental.es",nocase; classtype:attempted-recon; sid:200004764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poligrafiapias.com",nocase; classtype:attempted-recon; sid:200004765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkadot-2021.com",nocase; classtype:attempted-recon; sid:200004766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkadot-france.fr",nocase; classtype:attempted-recon; sid:200004767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkastarter.com.co",nocase; classtype:attempted-recon; sid:200004768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polncocesvvip-charge.com",nocase; classtype:attempted-recon; sid:200004769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polncokesvvep-api.com",nocase; classtype:attempted-recon; sid:200004770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polskapoczta-ndqk.id-info0756.me",nocase; classtype:attempted-recon; sid:200004771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pomebiyou.net#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200004772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poncakesvvop-finance.com",nocase; classtype:attempted-recon; sid:200004773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poncokesswop-trade.com",nocase; classtype:attempted-recon; sid:200004774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ponkaceswwap-charge.com",nocase; classtype:attempted-recon; sid:200004775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ponkaceswwap-investments.com",nocase; classtype:attempted-recon; sid:200004776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ponkaceswwop-finance.com",nocase; classtype:attempted-recon; sid:200004777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ponncaceswep-api.com",nocase; classtype:attempted-recon; sid:200004778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pope0w.webwave.dev",nocase; classtype:attempted-recon; sid:200004779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal-abgleich-center.com",nocase; classtype:attempted-recon; sid:200004780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal-spkhome-update.com",nocase; classtype:attempted-recon; sid:200004781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; classtype:attempted-recon; sid:200004782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portalid-spk.com",nocase; classtype:attempted-recon; sid:200004783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portalspkfin.com",nocase; classtype:attempted-recon; sid:200004784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portalspkfinanz.com",nocase; classtype:attempted-recon; sid:200004785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"porutchi-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200004786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posadalalucia.com.ar",nocase; classtype:attempted-recon; sid:200004787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posb-online.netlify.app",nocase; classtype:attempted-recon; sid:200004788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poshqd.classsizecounts.com",nocase; classtype:attempted-recon; sid:200004789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-secu.fr",nocase; classtype:attempted-recon; sid:200004790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-swiss-ch-info-964f35.ingress-bonde.easywp.com",nocase; classtype:attempted-recon; sid:200004791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-track.ch",nocase; classtype:attempted-recon; sid:200004792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post.ch-swissposte.mrssl.org",nocase; classtype:attempted-recon; sid:200004793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posta-sk.top",nocase; classtype:attempted-recon; sid:200004794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posta.sk.u1480692.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaieban.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200004796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postale-service-hhcz.fr.swtest.ru",nocase; classtype:attempted-recon; sid:200004797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaleclien-112-127-85-16.185-107-80-19.plesk.page",nocase; classtype:attempted-recon; sid:200004798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaleclien-114-127-85-16.185-107-80-19.plesk.page",nocase; classtype:attempted-recon; sid:200004799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaledsp2.conexion.fr.savealifemw.org",nocase; classtype:attempted-recon; sid:200004800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalewa2.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200004801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalfees-uk.com",nocase; classtype:attempted-recon; sid:200004802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postamanika.com",nocase; classtype:attempted-recon; sid:200004803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postbus103.nl",nocase; classtype:attempted-recon; sid:200004804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postch.payment-safe.org",nocase; classtype:attempted-recon; sid:200004805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postch.trackspay.org",nocase; classtype:attempted-recon; sid:200004806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postchtrackingorder.com",nocase; classtype:attempted-recon; sid:200004807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posten-post.it",nocase; classtype:attempted-recon; sid:200004808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postfincsa.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-deliveryupdates.com",nocase; classtype:attempted-recon; sid:200004810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-issue-redelivery.com",nocase; classtype:attempted-recon; sid:200004811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-tracking-update.com",nocase; classtype:attempted-recon; sid:200004812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice.co.uk-billing.delivery",nocase; classtype:attempted-recon; sid:200004813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice61-t.neolane.net",nocase; classtype:attempted-recon; sid:200004814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsch-947265.ingress-erytho.easywp.com",nocase; classtype:attempted-recon; sid:200004815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poverty.monespace.net",nocase; classtype:attempted-recon; sid:200004816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powercase.shoplineapp.com",nocase; classtype:attempted-recon; sid:200004817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powerful-kiwi-guan.glitch.me",nocase; classtype:attempted-recon; sid:200004818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powertech-solutions-elevator.com",nocase; classtype:attempted-recon; sid:200004819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pp-aid.com",nocase; classtype:attempted-recon; sid:200004820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pphwm.app.link",nocase; classtype:attempted-recon; sid:200004821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppiquickclaim.co.uk",nocase; classtype:attempted-recon; sid:200004822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppkalqudwah.ulm.ac.id",nocase; classtype:attempted-recon; sid:200004823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"practicaleduskills.in",nocase; classtype:attempted-recon; sid:200004824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"precursorchem.com",nocase; classtype:attempted-recon; sid:200004825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"premioscocacolafemsamandarin.com",nocase; classtype:attempted-recon; sid:200004826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"premiumnoidaescorts.com",nocase; classtype:attempted-recon; sid:200004827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prepaid.firstdata.com",nocase; classtype:attempted-recon; sid:200004828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"preppingconfidence.com",nocase; classtype:attempted-recon; sid:200004829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prernaindustries.com",nocase; classtype:attempted-recon; sid:200004830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prevencionvialbcpzonasegura.esc-pons.com",nocase; classtype:attempted-recon; sid:200004831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prevencionvialbcpzonaseguras.esc-pons.com",nocase; classtype:attempted-recon; sid:200004832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prewkchosd.rf.gd",nocase; classtype:attempted-recon; sid:200004833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikany.com",nocase; classtype:attempted-recon; sid:200004834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikolnaya.com",nocase; classtype:attempted-recon; sid:200004835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prim-emilianozapata.edu.mx",nocase; classtype:attempted-recon; sid:200004836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primelive.eastus.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200004837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primeshopee.com",nocase; classtype:attempted-recon; sid:200004838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"printtoner.com.mx",nocase; classtype:attempted-recon; sid:200004839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovry-page-protection-232.web.id",nocase; classtype:attempted-recon; sid:200004840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovry-page-protection-4565544.web.id",nocase; classtype:attempted-recon; sid:200004841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacygxterms.yolasite.com",nocase; classtype:attempted-recon; sid:200004842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privat-daten-schutz-spk.com",nocase; classtype:attempted-recon; sid:200004843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privatgrub-bkp.duckdns.org",nocase; classtype:attempted-recon; sid:200004844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"problemclub.id",nocase; classtype:attempted-recon; sid:200004845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"probnick1.xyz",nocase; classtype:attempted-recon; sid:200004846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"productkeyforfree.com",nocase; classtype:attempted-recon; sid:200004847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"professional-house-cleaning.ca",nocase; classtype:attempted-recon; sid:200004848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"programe-alba.ro",nocase; classtype:attempted-recon; sid:200004849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"projectlovewell.com",nocase; classtype:attempted-recon; sid:200004850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prok.webd.pl",nocase; classtype:attempted-recon; sid:200004851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promaclive00.byethost7.com",nocase; classtype:attempted-recon; sid:200004852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promehedinti.ro",nocase; classtype:attempted-recon; sid:200004853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promeric4.webcindario.com",nocase; classtype:attempted-recon; sid:200004854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-final.byethost12.com",nocase; classtype:attempted-recon; sid:200004855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-web2.byethost7.com",nocase; classtype:attempted-recon; sid:200004856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-web4.byethost24.com",nocase; classtype:attempted-recon; sid:200004857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaa0.byethost12.com",nocase; classtype:attempted-recon; sid:200004858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericad.byethost6.com",nocase; classtype:attempted-recon; sid:200004859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaisn.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaltda.com",nocase; classtype:attempted-recon; sid:200004861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonlifd.byethost15.com",nocase; classtype:attempted-recon; sid:200004862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonline.byethost6.com",nocase; classtype:attempted-recon; sid:200004863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonlint.byethost17.com",nocase; classtype:attempted-recon; sid:200004864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericasv.eb2a.com",nocase; classtype:attempted-recon; sid:200004865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericsvonli.byethost18.com",nocase; classtype:attempted-recon; sid:200004866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promeriicaenline.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promexsv000.byethost7.com",nocase; classtype:attempted-recon; sid:200004868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proomericaenline.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"property-ads-marketplace.libidokala.com",nocase; classtype:attempted-recon; sid:200004870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosto-i-vkusno.com",nocase; classtype:attempted-recon; sid:200004871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosxsiuser.myfreesites.net",nocase; classtype:attempted-recon; sid:200004872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect-4d56vca.surge.sh",nocase; classtype:attempted-recon; sid:200004873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect.sabzgoltab.com",nocase; classtype:attempted-recon; sid:200004874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect.theresortweddings.com",nocase; classtype:attempted-recon; sid:200004875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protection-newpayee-halifax.com",nocase; classtype:attempted-recon; sid:200004876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protectyouraccount.toonlineamazonpresence.one",nocase; classtype:attempted-recon; sid:200004877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proteksion-accts1321sdsd.cf",nocase; classtype:attempted-recon; sid:200004878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protelesis.cl",nocase; classtype:attempted-recon; sid:200004879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proximolaw.com",nocase; classtype:attempted-recon; sid:200004880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebacovid1912.byethost9.com",nocase; classtype:attempted-recon; sid:200004881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebamaricoyo.hostfree.pw",nocase; classtype:attempted-recon; sid:200004882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebaparami.hostfree.pw",nocase; classtype:attempted-recon; sid:200004883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebaparayo.byethost7.com",nocase; classtype:attempted-recon; sid:200004884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebassitio.unaux.com",nocase; classtype:attempted-recon; sid:200004885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"psupport.apple.com.pple.com",nocase; classtype:attempted-recon; sid:200004886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pt08.com",nocase; classtype:attempted-recon; sid:200004887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ptbdigitalsolutions.co.za",nocase; classtype:attempted-recon; sid:200004888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ptn.co.id",nocase; classtype:attempted-recon; sid:200004889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"publisan6373.byethost14.com",nocase; classtype:attempted-recon; sid:200004890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"publish-p43452-e180057.adobeaemcloud.com",nocase; classtype:attempted-recon; sid:200004891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puciss.hyperphp.com",nocase; classtype:attempted-recon; sid:200004892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puffing.com.pk",nocase; classtype:attempted-recon; sid:200004893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pulsartoken-giveaway.com",nocase; classtype:attempted-recon; sid:200004894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pulselead.org",nocase; classtype:attempted-recon; sid:200004895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puneinfoguide.com",nocase; classtype:attempted-recon; sid:200004896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puneinfoguide.eclatmediasolution.website",nocase; classtype:attempted-recon; sid:200004897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puroteksion-acctssds1321d.cf",nocase; classtype:attempted-recon; sid:200004898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puroxymembrane.com",nocase; classtype:attempted-recon; sid:200004899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pvgzfgmab0j.typeform.com",nocase; classtype:attempted-recon; sid:200004900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pydttuxozmzjmjqxayxfxhycfr-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pzbuys.xyz",nocase; classtype:attempted-recon; sid:200004902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pzjsw.cn",nocase; classtype:attempted-recon; sid:200004903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q06huk.webwave.dev",nocase; classtype:attempted-recon; sid:200004904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q5ar4.skipdns.link",nocase; classtype:attempted-recon; sid:200004905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q6g474zyu9y.typeform.com",nocase; classtype:attempted-recon; sid:200004906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qa.smbc-card.com",nocase; classtype:attempted-recon; sid:200004907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; classtype:attempted-recon; sid:200004908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qbocd.csb.app",nocase; classtype:attempted-recon; sid:200004909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qdi73.d0g67.pquim-co.com",nocase; classtype:attempted-recon; sid:200004910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qf3nt.codesandbox.io",nocase; classtype:attempted-recon; sid:200004912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qfw.tosex35238.workers.dev",nocase; classtype:attempted-recon; sid:200004913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qguacnakqcdqvuvggaaqwdadueachh.66ghz.com",nocase; classtype:attempted-recon; sid:200004914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qhmqhgnfqbcoxkwamsioilhdmv-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qhwoht.cn",nocase; classtype:attempted-recon; sid:200004916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qikgen.com.au",nocase; classtype:attempted-recon; sid:200004917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qkhbuehotm.synergia.ps",nocase; classtype:attempted-recon; sid:200004918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qlgu1.codesandbox.io",nocase; classtype:attempted-recon; sid:200004919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qsdqsx.ns12-wistee.fr",nocase; classtype:attempted-recon; sid:200004920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quad-as.de",nocase; classtype:attempted-recon; sid:200004921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quadfabrik.de",nocase; classtype:attempted-recon; sid:200004922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualium.mx",nocase; classtype:attempted-recon; sid:200004923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qubectravel.com",nocase; classtype:attempted-recon; sid:200004924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"queroquarto.com",nocase; classtype:attempted-recon; sid:200004925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"queroquarto.com.br",nocase; classtype:attempted-recon; sid:200004926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quickqatar.com",nocase; classtype:attempted-recon; sid:200004927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quinaroja.com",nocase; classtype:attempted-recon; sid:200004928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quintanaevents.co",nocase; classtype:attempted-recon; sid:200004929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quirky-mcnulty.23-94-50-242.plesk.page",nocase; classtype:attempted-recon; sid:200004930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quota.creatorlink.net",nocase; classtype:attempted-recon; sid:200004931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qusarv.consisavrt.com.br",nocase; classtype:attempted-recon; sid:200004932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qw4g5w3sl31.typeform.com",nocase; classtype:attempted-recon; sid:200004933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qwikkar.com",nocase; classtype:attempted-recon; sid:200004934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qxefgnrjbrekgquvcxteyufrxfpquvcxteyufdk.66ghz.com",nocase; classtype:attempted-recon; sid:200004935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-cms.org",nocase; classtype:attempted-recon; sid:200004936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#bucky@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#ewhalley@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#mike_tracy@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#verg_yazzie@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.versorecto.org",nocase; classtype:attempted-recon; sid:200004941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r7hwk3.cn",nocase; classtype:attempted-recon; sid:200004942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r7vfe.csb.app",nocase; classtype:attempted-recon; sid:200004943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ra12s.hyperphp.com",nocase; classtype:attempted-recon; sid:200004944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; classtype:attempted-recon; sid:200004945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.li",nocase; classtype:attempted-recon; sid:200004946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rackenfordlabs.com",nocase; classtype:attempted-recon; sid:200004947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"racuncinta-indonesia.com",nocase; classtype:attempted-recon; sid:200004948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"radforddoors.cl",nocase; classtype:attempted-recon; sid:200004949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"radioimagem3d.com.br",nocase; classtype:attempted-recon; sid:200004950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rajwebtechnology.com",nocase; classtype:attempted-recon; sid:200004951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakinfo5.er-5.top",nocase; classtype:attempted-recon; sid:200004952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakinfo6.oa-1.top",nocase; classtype:attempted-recon; sid:200004953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakinfo9.ea-4.top",nocase; classtype:attempted-recon; sid:200004954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.buogfbizkugf.gq",nocase; classtype:attempted-recon; sid:200004955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.bycsaxwdqunhh.gq",nocase; classtype:attempted-recon; sid:200004956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.gzllhpq.gq",nocase; classtype:attempted-recon; sid:200004957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.motpefhnpvyz.gq",nocase; classtype:attempted-recon; sid:200004958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.auqu0ei.cf",nocase; classtype:attempted-recon; sid:200004959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.cf",nocase; classtype:attempted-recon; sid:200004960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.ga",nocase; classtype:attempted-recon; sid:200004961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.gq",nocase; classtype:attempted-recon; sid:200004962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.vmveono.ga",nocase; classtype:attempted-recon; sid:200004963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-update.gmuzwgi.ml",nocase; classtype:attempted-recon; sid:200004964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-update.ldlmzzz.ml",nocase; classtype:attempted-recon; sid:200004965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten.co.ip.8euq3pq.gq",nocase; classtype:attempted-recon; sid:200004966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten.co.ip.w2qtjwo.cf",nocase; classtype:attempted-recon; sid:200004967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt1.rk1-info.top",nocase; classtype:attempted-recon; sid:200004968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt11.i10-info.top",nocase; classtype:attempted-recon; sid:200004969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt2.sk2-info.top",nocase; classtype:attempted-recon; sid:200004970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt4.tk4-info.top",nocase; classtype:attempted-recon; sid:200004971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt5.sk5-info.top",nocase; classtype:attempted-recon; sid:200004972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt6.ok5-info.top",nocase; classtype:attempted-recon; sid:200004973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakt9.ei8-info.top",nocase; classtype:attempted-recon; sid:200004974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktraphyp.byethost7.com",nocase; classtype:attempted-recon; sid:200004975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktuen.chianqjf.com",nocase; classtype:attempted-recon; sid:200004976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktuen.co.jp.actatlys.com",nocase; classtype:attempted-recon; sid:200004977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktuen.mnjzw.com",nocase; classtype:attempted-recon; sid:200004978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuten.co.jp.oadkxoe.cf",nocase; classtype:attempted-recon; sid:200004979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakutenaal.co.jjp.by2.net.cn",nocase; classtype:attempted-recon; sid:200004980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakutenll.co.jjp.rozmiary.net",nocase; classtype:attempted-recon; sid:200004981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ramgarhiamatrimonial.ca",nocase; classtype:attempted-recon; sid:200004982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ranchosanantonio5m.com",nocase; classtype:attempted-recon; sid:200004983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.club",nocase; classtype:attempted-recon; sid:200004984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.com",nocase; classtype:attempted-recon; sid:200004985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.fun",nocase; classtype:attempted-recon; sid:200004986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.info",nocase; classtype:attempted-recon; sid:200004987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.net",nocase; classtype:attempted-recon; sid:200004988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.org",nocase; classtype:attempted-recon; sid:200004989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumlake.xyz",nocase; classtype:attempted-recon; sid:200004990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.club",nocase; classtype:attempted-recon; sid:200004991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.com",nocase; classtype:attempted-recon; sid:200004992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.fun",nocase; classtype:attempted-recon; sid:200004993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.info",nocase; classtype:attempted-recon; sid:200004994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.net",nocase; classtype:attempted-recon; sid:200004995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.org",nocase; classtype:attempted-recon; sid:200004996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.site",nocase; classtype:attempted-recon; sid:200004997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumpanel.space",nocase; classtype:attempted-recon; sid:200004998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumproject.club",nocase; classtype:attempted-recon; sid:200004999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumproject.su",nocase; classtype:attempted-recon; sid:200005000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumproject.xyz",nocase; classtype:attempted-recon; sid:200005001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumrow.com",nocase; classtype:attempted-recon; sid:200005002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumrow.net",nocase; classtype:attempted-recon; sid:200005003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumrow.org",nocase; classtype:attempted-recon; sid:200005004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumshow.com",nocase; classtype:attempted-recon; sid:200005005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumshow.net",nocase; classtype:attempted-recon; sid:200005006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumshow.org",nocase; classtype:attempted-recon; sid:200005007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ranjplay.com",nocase; classtype:attempted-recon; sid:200005008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rappel-authentification-ecoute.freeweb.pk",nocase; classtype:attempted-recon; sid:200005009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raydiom.io",nocase; classtype:attempted-recon; sid:200005010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raydium.cc",nocase; classtype:attempted-recon; sid:200005011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"razcdf.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbcmontgomery.com",nocase; classtype:attempted-recon; sid:200005013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbcroyalebank.com",nocase; classtype:attempted-recon; sid:200005014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbveuyeeigevyeegvgy.smartprimaqualita.com",nocase; classtype:attempted-recon; sid:200005015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rcproductionsjm.com",nocase; classtype:attempted-recon; sid:200005016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rcweb-domain.web.app#living@zilch.nl",nocase; classtype:attempted-recon; sid:200005017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rd8um.app.link",nocase; classtype:attempted-recon; sid:200005018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rdevro.hyperphp.com",nocase; classtype:attempted-recon; sid:200005019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rdxcvoilftxcui.square.site",nocase; classtype:attempted-recon; sid:200005020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-direct-me.com",nocase; classtype:attempted-recon; sid:200005021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-redirection-acc-id923872635122.blogspot.com",nocase; classtype:attempted-recon; sid:200005022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-redirection-pp-account-id98763432.blogspot.com",nocase; classtype:attempted-recon; sid:200005023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re4nm.csb.app",nocase; classtype:attempted-recon; sid:200005024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"react-ba2roi.stackblitz.io",nocase; classtype:attempted-recon; sid:200005025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real-coda-shop.duckdns.org",nocase; classtype:attempted-recon; sid:200005026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real-estate-page-id-8821973834.theblucompany.com",nocase; classtype:attempted-recon; sid:200005027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real.de.seller.bookings.siharkaboy.boyolali.go.id",nocase; classtype:attempted-recon; sid:200005028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realclub.de",nocase; classtype:attempted-recon; sid:200005029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realcodashopfreediamonds.freeddns.com",nocase; classtype:attempted-recon; sid:200005030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realdatatest.isolusi-bf.com",nocase; classtype:attempted-recon; sid:200005031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestate-page-10843446024.expresspestcontrol.co.nz",nocase; classtype:attempted-recon; sid:200005032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestate-page-homes.com",nocase; classtype:attempted-recon; sid:200005033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestateagentlisting.tv",nocase; classtype:attempted-recon; sid:200005034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realhypermarket.me",nocase; classtype:attempted-recon; sid:200005035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realmoneysend.com",nocase; classtype:attempted-recon; sid:200005036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realrenderstudio.it",nocase; classtype:attempted-recon; sid:200005037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reareo.duramaxservice.com",nocase; classtype:attempted-recon; sid:200005038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recallvapor.top",nocase; classtype:attempted-recon; sid:200005039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recevirementlbc.eu",nocase; classtype:attempted-recon; sid:200005040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recharge-fr.net",nocase; classtype:attempted-recon; sid:200005041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rechtsanwaltskanzlei-spanien.de",nocase; classtype:attempted-recon; sid:200005042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recomfirmidentity-pagecenter.ml",nocase; classtype:attempted-recon; sid:200005043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reconfirmpost287846656.us",nocase; classtype:attempted-recon; sid:200005044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoveraccount0.byethost3.com",nocase; classtype:attempted-recon; sid:200005045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoverinst.ru",nocase; classtype:attempted-recon; sid:200005046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoverty-accountmailsremindupdateweb-cgi.cloudns.ph",nocase; classtype:attempted-recon; sid:200005047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recovery.d38nt4lo54d3l5.amplifyapp.com",nocase; classtype:attempted-recon; sid:200005048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoveryconfirm.co.vu",nocase; classtype:attempted-recon; sid:200005049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recso.org",nocase; classtype:attempted-recon; sid:200005050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redbysfrgroupebox.myfreesites.net",nocase; classtype:attempted-recon; sid:200005051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reddotarms.com",nocase; classtype:attempted-recon; sid:200005052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redeem-microsoft-code.sitey.me",nocase; classtype:attempted-recon; sid:200005053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redeem-myservices.com",nocase; classtype:attempted-recon; sid:200005054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redefinedindustries.com",nocase; classtype:attempted-recon; sid:200005055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rediractionid547012016089540218057.blogspot.com",nocase; classtype:attempted-recon; sid:200005056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect-office365.serveusers.com",nocase; classtype:attempted-recon; sid:200005057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.viglink.com?%uf%rj%fx%u3&key=fd5de1d096b38be9fffd6ddc1948df4f&u=%61%70%69%2e%61%64%64%74%68%69%73%2e%63%6f%6d%2f%6f%65%78%63%68%61%6e%67%65%2f%30%2e%38%2f%77%72%61%70%2f%6f%70%65%6e%67%72%61%70%68%e2%80%8c%75%72%6c%3dahr0chm6ly9ua3yuchvil3h5nt83oet4elzsag1mzndzjmfsdd1tzwrpysnav2x0wvhomfpvqnpkr2x1y0hkcgvtrxvim0puolbcy3ppmu4yzgrladg2ennfduhvdu02qxphujjmuhv5zw5ork5ecvu=",nocase; classtype:attempted-recon; sid:200005058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.voici-news.fr",nocase; classtype:attempted-recon; sid:200005059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirectna.financeofaustraliamortgageinc.online",nocase; classtype:attempted-recon; sid:200005060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redpichinfa.byethost7.com",nocase; classtype:attempted-recon; sid:200005061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reebe.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200005062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"referral.hosannahfministry.com.ng",nocase; classtype:attempted-recon; sid:200005063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reforestindia.in",nocase; classtype:attempted-recon; sid:200005064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regina.ninetendev.com",nocase; classtype:attempted-recon; sid:200005065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regionpostalelogsession.zyrosite.com",nocase; classtype:attempted-recon; sid:200005066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regisdrive.xyz",nocase; classtype:attempted-recon; sid:200005067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"register-my-device.com",nocase; classtype:attempted-recon; sid:200005068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registerpichinch.ihostfull.com",nocase; classtype:attempted-recon; sid:200005069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registery001.byethost6.com",nocase; classtype:attempted-recon; sid:200005070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registrdatapichi.ihostfull.com",nocase; classtype:attempted-recon; sid:200005071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reglic.in",nocase; classtype:attempted-recon; sid:200005072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regrets.servehalflife.com",nocase; classtype:attempted-recon; sid:200005073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regularsweeps.xyz",nocase; classtype:attempted-recon; sid:200005074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reignbike.com",nocase; classtype:attempted-recon; sid:200005075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rekapuolam.blogspot.com",nocase; classtype:attempted-recon; sid:200005076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rektuen.jp.whkuaican.com",nocase; classtype:attempted-recon; sid:200005077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rektuen.ywcimei.com",nocase; classtype:attempted-recon; sid:200005078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rekutieno.mint-rs.com",nocase; classtype:attempted-recon; sid:200005079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rekutienon.modaask.com",nocase; classtype:attempted-recon; sid:200005080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"relaxae.swipepages.page",nocase; classtype:attempted-recon; sid:200005081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"relevant.systems",nocase; classtype:attempted-recon; sid:200005082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remasznc.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remillardconsulting.com",nocase; classtype:attempted-recon; sid:200005084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remittance369297292749.goshly.com",nocase; classtype:attempted-recon; sid:200005085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remove-device.shop",nocase; classtype:attempted-recon; sid:200005086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rempitem.agilecrm.com",nocase; classtype:attempted-recon; sid:200005087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remsy.app.link",nocase; classtype:attempted-recon; sid:200005088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rencon.ch.net2care.com",nocase; classtype:attempted-recon; sid:200005089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rendangunitutie.com",nocase; classtype:attempted-recon; sid:200005090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"renew.trusted-travelers-online.com",nocase; classtype:attempted-recon; sid:200005091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reoauthv1online-login.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200005092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"repeating.servehalflife.com",nocase; classtype:attempted-recon; sid:200005093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"repl-mess.myfreesites.net",nocase; classtype:attempted-recon; sid:200005094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"replilixecupiac0.byethost15.com",nocase; classtype:attempted-recon; sid:200005095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"replug.link",nocase; classtype:attempted-recon; sid:200005096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"request-payee-now.com",nocase; classtype:attempted-recon; sid:200005097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbet.blogspot.com",nocase; classtype:attempted-recon; sid:200005098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbetsgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200005099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reservation1-scure.redirectme.net",nocase; classtype:attempted-recon; sid:200005100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reservation2-scure.redirectme.net",nocase; classtype:attempted-recon; sid:200005101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reservation3-scure.redirectme.net",nocase; classtype:attempted-recon; sid:200005102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resgateponto.me",nocase; classtype:attempted-recon; sid:200005103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resources.remote-ing.services",nocase; classtype:attempted-recon; sid:200005104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restaurantlhorizon.be",nocase; classtype:attempted-recon; sid:200005105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200005106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200005108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restore-session-help.com",nocase; classtype:attempted-recon; sid:200005109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restricted-newonline-payee.net",nocase; classtype:attempted-recon; sid:200005110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restricted-newpayee.com",nocase; classtype:attempted-recon; sid:200005111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resu.page.link",nocase; classtype:attempted-recon; sid:200005112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retiro.cl",nocase; classtype:attempted-recon; sid:200005113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retraiteenaction.ca",nocase; classtype:attempted-recon; sid:200005114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reversepayments.net",nocase; classtype:attempted-recon; sid:200005115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review-mynew-device.com",nocase; classtype:attempted-recon; sid:200005116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review.3utilities.com",nocase; classtype:attempted-recon; sid:200005117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revision-spk.com",nocase; classtype:attempted-recon; sid:200005118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revistametro.com.ar",nocase; classtype:attempted-recon; sid:200005119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revoltgamez.com",nocase; classtype:attempted-recon; sid:200005120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reward-garena-freefireff.blogspot.com",nocase; classtype:attempted-recon; sid:200005121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rewardff-garena.xyz",nocase; classtype:attempted-recon; sid:200005122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rex.2-vols.xyz",nocase; classtype:attempted-recon; sid:200005123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rextraening.dk",nocase; classtype:attempted-recon; sid:200005124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rguga.ro",nocase; classtype:attempted-recon; sid:200005125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhilo.co.in",nocase; classtype:attempted-recon; sid:200005126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinomultimedia.com",nocase; classtype:attempted-recon; sid:200005127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhrinternational.carambola.cl",nocase; classtype:attempted-recon; sid:200005128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"richardbashara.com",nocase; classtype:attempted-recon; sid:200005129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rimasnik.co.vu",nocase; classtype:attempted-recon; sid:200005130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riotintoweb.com",nocase; classtype:attempted-recon; sid:200005131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ripantadiles.com",nocase; classtype:attempted-recon; sid:200005132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riptide-operation.ru.com",nocase; classtype:attempted-recon; sid:200005133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riptiklo-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200005134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ristorantesancolombanolucca.it",nocase; classtype:attempted-recon; sid:200005135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riversweeps.org",nocase; classtype:attempted-recon; sid:200005136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rizarichempire.com",nocase; classtype:attempted-recon; sid:200005137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rizkyinterior.com",nocase; classtype:attempted-recon; sid:200005138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rj1kx.app.link",nocase; classtype:attempted-recon; sid:200005139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkanet.com",nocase; classtype:attempted-recon; sid:200005140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkgreany-seg3-2.kk.sopqa.arg.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200005141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkindustries.co",nocase; classtype:attempted-recon; sid:200005142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rlink.vn",nocase; classtype:attempted-recon; sid:200005143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rm-parcel11429-uk.com",nocase; classtype:attempted-recon; sid:200005144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rm-shippingprocess.com",nocase; classtype:attempted-recon; sid:200005145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmcdigitalbazar.com",nocase; classtype:attempted-recon; sid:200005146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmid-98321938.com",nocase; classtype:attempted-recon; sid:200005147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmsfcc.com",nocase; classtype:attempted-recon; sid:200005148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmzengenharia.blogspot.com",nocase; classtype:attempted-recon; sid:200005149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rn3pc9bqfbv.typeform.com",nocase; classtype:attempted-recon; sid:200005150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rnercari-login.gdnorth.cn",nocase; classtype:attempted-recon; sid:200005151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roadgo.co.uk",nocase; classtype:attempted-recon; sid:200005152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roastedllc-40dc0.web.app",nocase; classtype:attempted-recon; sid:200005153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200005154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rockettpedals.com",nocase; classtype:attempted-recon; sid:200005155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roisnoob.github.io",nocase; classtype:attempted-recon; sid:200005156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roitcou.hyperphp.com",nocase; classtype:attempted-recon; sid:200005157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rokutanm-ctmrrj.cc",nocase; classtype:attempted-recon; sid:200005158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rokutanm-rrbrb.cc",nocase; classtype:attempted-recon; sid:200005159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rolinadd.surveysparrow.com",nocase; classtype:attempted-recon; sid:200005160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rollardtours.com",nocase; classtype:attempted-recon; sid:200005161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronces.co.vu",nocase; classtype:attempted-recon; sid:200005162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rondelbarrilito.com",nocase; classtype:attempted-recon; sid:200005163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninchain-bridge.com",nocase; classtype:attempted-recon; sid:200005164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet-connect.com",nocase; classtype:attempted-recon; sid:200005165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet.cm",nocase; classtype:attempted-recon; sid:200005166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet.link",nocase; classtype:attempted-recon; sid:200005167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwebapp.com",nocase; classtype:attempted-recon; sid:200005168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronow92636.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200005169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rosalinas-initial-project-30ac52.webflow.io",nocase; classtype:attempted-recon; sid:200005170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotimi.pandaform.com",nocase; classtype:attempted-recon; sid:200005171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotseezunft.ch.tcorner.fr",nocase; classtype:attempted-recon; sid:200005172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundcube-production-cf.tx1.mailhostbox.com",nocase; classtype:attempted-recon; sid:200005173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundtreeconsulting.net",nocase; classtype:attempted-recon; sid:200005174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roupakids.blogspot.com",nocase; classtype:attempted-recon; sid:200005175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id0343.surge.sh",nocase; classtype:attempted-recon; sid:200005176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id3f34.surge.sh",nocase; classtype:attempted-recon; sid:200005177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id4870.surge.sh",nocase; classtype:attempted-recon; sid:200005178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id5403.surge.sh",nocase; classtype:attempted-recon; sid:200005179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id5787.surge.sh",nocase; classtype:attempted-recon; sid:200005180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal-id6411.surge.sh",nocase; classtype:attempted-recon; sid:200005181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalpostcards.be",nocase; classtype:attempted-recon; sid:200005182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalwindsorpub.com",nocase; classtype:attempted-recon; sid:200005183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rplg.co",nocase; classtype:attempted-recon; sid:200005185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rreeufffsaussaa3.app.link",nocase; classtype:attempted-recon; sid:200005186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rseauxmobile01.ulcraft.com",nocase; classtype:attempted-recon; sid:200005187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsp.ogivart.us",nocase; classtype:attempted-recon; sid:200005188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rstools.club",nocase; classtype:attempted-recon; sid:200005189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsujkblokqlyqfonpzgztejdji-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rtadnplmk.cyou",nocase; classtype:attempted-recon; sid:200005191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ruekrew.com",nocase; classtype:attempted-recon; sid:200005192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescapeapk.com",nocase; classtype:attempted-recon; sid:200005193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runni24.byethost7.com",nocase; classtype:attempted-recon; sid:200005194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rushlawnandsnow.ml",nocase; classtype:attempted-recon; sid:200005195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rwengraving.com",nocase; classtype:attempted-recon; sid:200005196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ryasuministros.com",nocase; classtype:attempted-recon; sid:200005197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ryonstravel.com",nocase; classtype:attempted-recon; sid:200005198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s-paypalinfo.ml",nocase; classtype:attempted-recon; sid:200005199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s-sarfati.co.il",nocase; classtype:attempted-recon; sid:200005200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.free.fr",nocase; classtype:attempted-recon; sid:200005201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.kekk.is",nocase; classtype:attempted-recon; sid:200005202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.luwank.com",nocase; classtype:attempted-recon; sid:200005203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.yam.com",nocase; classtype:attempted-recon; sid:200005204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sa-www4-irs-gov-refund-irfof-wmsp.unaux.com",nocase; classtype:attempted-recon; sid:200005205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sa-www4-irs-gov.movementsinmotion.com",nocase; classtype:attempted-recon; sid:200005206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saatvikhomes.com",nocase; classtype:attempted-recon; sid:200005207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sabaicabins.com",nocase; classtype:attempted-recon; sid:200005208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sabssyndicate.com.bd",nocase; classtype:attempted-recon; sid:200005209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sacsassinatura.com",nocase; classtype:attempted-recon; sid:200005210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sadervoyages.intnet.mu",nocase; classtype:attempted-recon; sid:200005211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safe-repotpage.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safety.insecur-page.workers.dev",nocase; classtype:attempted-recon; sid:200005213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safetyconsultantehs.com",nocase; classtype:attempted-recon; sid:200005214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safgasgiasgasgasgas.pages.dev",nocase; classtype:attempted-recon; sid:200005215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgiristikla.blogspot.com",nocase; classtype:attempted-recon; sid:200005217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safying-page-report1028.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahc892190jf19y83.yicori5768-t0ypy-yy.workers.dev",nocase; classtype:attempted-recon; sid:200005219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahyacollege.com",nocase; classtype:attempted-recon; sid:200005220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saintbarkleyshoes.com",nocase; classtype:attempted-recon; sid:200005221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saitadobrasil.com.br",nocase; classtype:attempted-recon; sid:200005222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; classtype:attempted-recon; sid:200005223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sakura-ad-sakurainfo.cn",nocase; classtype:attempted-recon; sid:200005224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saldospc.com",nocase; classtype:attempted-recon; sid:200005225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"salemarten.com",nocase; classtype:attempted-recon; sid:200005226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saliksnas.lojaintegrada.com.br",nocase; classtype:attempted-recon; sid:200005227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samcool.org",nocase; classtype:attempted-recon; sid:200005228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samducksports.com",nocase; classtype:attempted-recon; sid:200005229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samircanel20.com",nocase; classtype:attempted-recon; sid:200005230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samkaleenjanmat.in",nocase; classtype:attempted-recon; sid:200005231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samnetakademi.com.tr",nocase; classtype:attempted-recon; sid:200005232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samvaadlife.com",nocase; classtype:attempted-recon; sid:200005233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanasunty.site",nocase; classtype:attempted-recon; sid:200005234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandboxww.top",nocase; classtype:attempted-recon; sid:200005235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandeeppk03.github.io",nocase; classtype:attempted-recon; sid:200005236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandiegooutdoorlivingca.com",nocase; classtype:attempted-recon; sid:200005237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sangahqw1.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sangeet-samrat-alladiyakhan-music-festival.com",nocase; classtype:attempted-recon; sid:200005239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjilkumar.com",nocase; classtype:attempted-recon; sid:200005240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjosewebdeveloper.com",nocase; classtype:attempted-recon; sid:200005241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sannittt.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanrite.page.link",nocase; classtype:attempted-recon; sid:200005243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanru.cd",nocase; classtype:attempted-recon; sid:200005244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sansom.us",nocase; classtype:attempted-recon; sid:200005245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santana-loading.mtxserv.com",nocase; classtype:attempted-recon; sid:200005246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santandaerbank.com",nocase; classtype:attempted-recon; sid:200005247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santander-arriba.hostfree.pw",nocase; classtype:attempted-recon; sid:200005248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santanderpl.com",nocase; classtype:attempted-recon; sid:200005249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santanderusduyu.hostfree.pw",nocase; classtype:attempted-recon; sid:200005250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santandhsflgh.byethost8.com",nocase; classtype:attempted-recon; sid:200005251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santaninfover.byethost33.com",nocase; classtype:attempted-recon; sid:200005252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sante-cov19.azurewebsites.net",nocase; classtype:attempted-recon; sid:200005253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santepluspharma.eclatmediasolution.website",nocase; classtype:attempted-recon; sid:200005254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santoriwoodworking.com",nocase; classtype:attempted-recon; sid:200005255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santoshdangi.com.np",nocase; classtype:attempted-recon; sid:200005256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saounps.com",nocase; classtype:attempted-recon; sid:200005257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saranlar.com",nocase; classtype:attempted-recon; sid:200005258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saritapariyar.com.np",nocase; classtype:attempted-recon; sid:200005259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sarudza.co.zw",nocase; classtype:attempted-recon; sid:200005260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satclient-p1.web.app",nocase; classtype:attempted-recon; sid:200005261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satemi.com.ve",nocase; classtype:attempted-recon; sid:200005262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satirize.3utilities.com",nocase; classtype:attempted-recon; sid:200005263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satpolpp.salatiga.go.id",nocase; classtype:attempted-recon; sid:200005264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"savingsfordentalcare.com",nocase; classtype:attempted-recon; sid:200005265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbe2021.com.br",nocase; classtype:attempted-recon; sid:200005266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbemskanila.com",nocase; classtype:attempted-recon; sid:200005267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbs-siebanlagen.de",nocase; classtype:attempted-recon; sid:200005268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sc0714e7134.byethost11.com",nocase; classtype:attempted-recon; sid:200005269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scb9813h918fh9831821yh.pefecim563-oiuyt-oijh.workers.dev",nocase; classtype:attempted-recon; sid:200005270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schaaf.ch.net2care.com",nocase; classtype:attempted-recon; sid:200005271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schroffenstein.online.fr",nocase; classtype:attempted-recon; sid:200005272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schule-niederrohrdorf.ch",nocase; classtype:attempted-recon; sid:200005273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scidecs.com",nocase; classtype:attempted-recon; sid:200005274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sconsumer.e-pagos.cl",nocase; classtype:attempted-recon; sid:200005275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scotiabank-yieldmorefinancing.ca",nocase; classtype:attempted-recon; sid:200005276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scotla-online.com",nocase; classtype:attempted-recon; sid:200005277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scouts.org.sv",nocase; classtype:attempted-recon; sid:200005278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scribble.dvrlists.com",nocase; classtype:attempted-recon; sid:200005279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdadadjewrjweudgjhxjsajshgjhcvnvveugticvbsdk.my-board.org",nocase; classtype:attempted-recon; sid:200005280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdfgfgdsfghjkdfgh.square.site",nocase; classtype:attempted-recon; sid:200005281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdfghjklvbnm.square.site",nocase; classtype:attempted-recon; sid:200005282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdgmjgvjvgj.sayamu33a90scuy981f.workers.dev",nocase; classtype:attempted-recon; sid:200005283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdgvsdvsdvs.blogspot.com",nocase; classtype:attempted-recon; sid:200005284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdofuo.top",nocase; classtype:attempted-recon; sid:200005285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdsdfdsfddkgfkkgjhjhjljrhtrujvgg.my-board.org",nocase; classtype:attempted-recon; sid:200005286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"se-connecter-au-webmail-la-poste--lapostenet0.yolasite.com",nocase; classtype:attempted-recon; sid:200005287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seacoastsurgery.com",nocase; classtype:attempted-recon; sid:200005288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seahoss.com",nocase; classtype:attempted-recon; sid:200005289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seanquincytv.com",nocase; classtype:attempted-recon; sid:200005290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebat-dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200005291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebene27.github.io",nocase; classtype:attempted-recon; sid:200005292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seceta.ro",nocase; classtype:attempted-recon; sid:200005293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"section-authpostaleactivationsmscard.tmweb.ru",nocase; classtype:attempted-recon; sid:200005294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-boncoincontrol.net",nocase; classtype:attempted-recon; sid:200005295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-citi10.serveuser.com",nocase; classtype:attempted-recon; sid:200005296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-halifax-device.com",nocase; classtype:attempted-recon; sid:200005297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-halifaxaccount.com",nocase; classtype:attempted-recon; sid:200005298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-id4fd7.surge.sh",nocase; classtype:attempted-recon; sid:200005299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-id89f3.surge.sh",nocase; classtype:attempted-recon; sid:200005300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-monitor.com",nocase; classtype:attempted-recon; sid:200005301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-myaccountdetails.com",nocase; classtype:attempted-recon; sid:200005302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-mynew-devices.com",nocase; classtype:attempted-recon; sid:200005303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-mytransfer.com",nocase; classtype:attempted-recon; sid:200005304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-onlinepayee.link",nocase; classtype:attempted-recon; sid:200005305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-payeeremoval.com",nocase; classtype:attempted-recon; sid:200005306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-runescape.xgm.rnp.mybluehost.me",nocase; classtype:attempted-recon; sid:200005307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-ssl-cdn.com",nocase; classtype:attempted-recon; sid:200005308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-web08.x24hr.com",nocase; classtype:attempted-recon; sid:200005309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.bankofamerica.com-login-sign-in-signonv2screen.go.suzukihaiphong.com.vn",nocase; classtype:attempted-recon; sid:200005310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.captisa.com",nocase; classtype:attempted-recon; sid:200005311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.facebook.com.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200005312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.legalmetric.com",nocase; classtype:attempted-recon; sid:200005313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.oldschool.com-rsa.ru",nocase; classtype:attempted-recon; sid:200005314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200005315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200005316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-rsa.ru",nocase; classtype:attempted-recon; sid:200005317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-rse.ru",nocase; classtype:attempted-recon; sid:200005318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200005319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescapev.com",nocase; classtype:attempted-recon; sid:200005320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure01ch.duckdns.org",nocase; classtype:attempted-recon; sid:200005321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure04citizen.ru",nocase; classtype:attempted-recon; sid:200005322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure04mandtinfo.ddns.net",nocase; classtype:attempted-recon; sid:200005323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure09-verification.com.ru",nocase; classtype:attempted-recon; sid:200005324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure270.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure271.servconfig.com",nocase; classtype:attempted-recon; sid:200005326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure279.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure285.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure290.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure300.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secured-mypayee.com",nocase; classtype:attempted-recon; sid:200005331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securefaxing.knorish.com",nocase; classtype:attempted-recon; sid:200005332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securefilefromyourcontact.macleayindoorsports.com.au",nocase; classtype:attempted-recon; sid:200005333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securegateway-ovhcloud.csl-sl.de",nocase; classtype:attempted-recon; sid:200005334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securelloyd-help-app.com",nocase; classtype:attempted-recon; sid:200005335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securelogin04auth01.3-a.net",nocase; classtype:attempted-recon; sid:200005336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securemy-logindetails.com",nocase; classtype:attempted-recon; sid:200005337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securepagealrts.co.vu",nocase; classtype:attempted-recon; sid:200005338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securesiteapp.com",nocase; classtype:attempted-recon; sid:200005339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secureyouraccountsafely.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"security-page-community-standards.blogspot.com",nocase; classtype:attempted-recon; sid:200005341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securitycode2021.hostfree.pw",nocase; classtype:attempted-recon; sid:200005342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securityprivacy.live",nocase; classtype:attempted-recon; sid:200005343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securityupdatereview-365online.com",nocase; classtype:attempted-recon; sid:200005344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secutityreport00.byethost16.com",nocase; classtype:attempted-recon; sid:200005345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seenpichinchaot.2host.in",nocase; classtype:attempted-recon; sid:200005346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seetheworldtravels.com.au",nocase; classtype:attempted-recon; sid:200005347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguincontracting.com",nocase; classtype:attempted-recon; sid:200005348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguranca-online.byethost11.com",nocase; classtype:attempted-recon; sid:200005349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"segurancampalerta.dnsking.ch",nocase; classtype:attempted-recon; sid:200005350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguraweb4646373.hostfree.pw",nocase; classtype:attempted-recon; sid:200005351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridad27.byethost18.com",nocase; classtype:attempted-recon; sid:200005352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridad89822.webcindario.com",nocase; classtype:attempted-recon; sid:200005353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadba.byethost6.com",nocase; classtype:attempted-recon; sid:200005354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadecuador.byethost17.com",nocase; classtype:attempted-recon; sid:200005355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadi0001.byethost3.com",nocase; classtype:attempted-recon; sid:200005356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridprom82711.byethost13.com",nocase; classtype:attempted-recon; sid:200005357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridprom82711.byethost6.com",nocase; classtype:attempted-recon; sid:200005358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguritybciudad.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguropichinchae.2host.in",nocase; classtype:attempted-recon; sid:200005360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss.blogspot.com",nocase; classtype:attempted-recon; sid:200005361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200005362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seksunappchek.rf.gd",nocase; classtype:attempted-recon; sid:200005364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selahattindemirciogluasm.com",nocase; classtype:attempted-recon; sid:200005365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selector26.gg",nocase; classtype:attempted-recon; sid:200005366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selector28.gg",nocase; classtype:attempted-recon; sid:200005367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sellrego.com",nocase; classtype:attempted-recon; sid:200005368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sem.my-drs.co.uk",nocase; classtype:attempted-recon; sid:200005369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"semadministratorcommunitystandardspages.co.vu",nocase; classtype:attempted-recon; sid:200005370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sen-manole.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sendo-meso.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sentinelshowcase.com",nocase; classtype:attempted-recon; sid:200005373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seracvtime.rf.gd",nocase; classtype:attempted-recon; sid:200005374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serbalokasondsksn.net",nocase; classtype:attempted-recon; sid:200005375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sertyxese.myfreesites.net",nocase; classtype:attempted-recon; sid:200005376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serv-secured-1.com",nocase; classtype:attempted-recon; sid:200005377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serv00othet05548f-com.umbler.net",nocase; classtype:attempted-recon; sid:200005378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-networksolutions.web.app",nocase; classtype:attempted-recon; sid:200005379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-sparkasse.de",nocase; classtype:attempted-recon; sid:200005380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-syncwallet.com",nocase; classtype:attempted-recon; sid:200005381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.31x4k.cn",nocase; classtype:attempted-recon; sid:200005382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.3wumg.cn",nocase; classtype:attempted-recon; sid:200005383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.53u16.cn",nocase; classtype:attempted-recon; sid:200005384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.558815.cn",nocase; classtype:attempted-recon; sid:200005385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.59t11ll8d8.cn",nocase; classtype:attempted-recon; sid:200005386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.6fm8uy09g3.cn",nocase; classtype:attempted-recon; sid:200005387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.8r5553.cn",nocase; classtype:attempted-recon; sid:200005388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.a8iaz.cn",nocase; classtype:attempted-recon; sid:200005389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.aac74.cn",nocase; classtype:attempted-recon; sid:200005390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.ajfjdy.cn",nocase; classtype:attempted-recon; sid:200005391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.axvyk.cn",nocase; classtype:attempted-recon; sid:200005392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.benyukeji.cn",nocase; classtype:attempted-recon; sid:200005393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.cbfz6d.cn",nocase; classtype:attempted-recon; sid:200005394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.dcjwhb.cn",nocase; classtype:attempted-recon; sid:200005395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.eng7jtwdfc.cn",nocase; classtype:attempted-recon; sid:200005396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.eungggcqi.cn",nocase; classtype:attempted-recon; sid:200005397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.gghh65.cn",nocase; classtype:attempted-recon; sid:200005398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.guoziang.cn",nocase; classtype:attempted-recon; sid:200005399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.iuxndtl.cn",nocase; classtype:attempted-recon; sid:200005400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.j9z845.cn",nocase; classtype:attempted-recon; sid:200005401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.jcklfh.cn",nocase; classtype:attempted-recon; sid:200005402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.ksu3b30.cn",nocase; classtype:attempted-recon; sid:200005403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.lianyuna.cn",nocase; classtype:attempted-recon; sid:200005404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.lqanuag.cn",nocase; classtype:attempted-recon; sid:200005405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.ltzptz.cn",nocase; classtype:attempted-recon; sid:200005406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.mnpkrt.cn",nocase; classtype:attempted-recon; sid:200005407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.mov7u.cn",nocase; classtype:attempted-recon; sid:200005408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.myzy114.cn",nocase; classtype:attempted-recon; sid:200005409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.nkis9znk02.cn",nocase; classtype:attempted-recon; sid:200005410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.nlarfs.cn",nocase; classtype:attempted-recon; sid:200005411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.nnynrk.cn",nocase; classtype:attempted-recon; sid:200005412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.panrid.cn",nocase; classtype:attempted-recon; sid:200005413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.pnrwfh.top",nocase; classtype:attempted-recon; sid:200005414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.shuwde.cn",nocase; classtype:attempted-recon; sid:200005415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.shzdrozl.cn",nocase; classtype:attempted-recon; sid:200005416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.snq0nqjjj5.cn",nocase; classtype:attempted-recon; sid:200005417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.snrzrj.cn",nocase; classtype:attempted-recon; sid:200005418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.tddgqk.cn",nocase; classtype:attempted-recon; sid:200005419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.ubknkp.cn",nocase; classtype:attempted-recon; sid:200005420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.ucvipt.cn",nocase; classtype:attempted-recon; sid:200005421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.v6066x8.cn",nocase; classtype:attempted-recon; sid:200005422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.vodom.shop",nocase; classtype:attempted-recon; sid:200005423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.weituig.cn",nocase; classtype:attempted-recon; sid:200005424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.whutlhc.cn",nocase; classtype:attempted-recon; sid:200005425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.whyixinkj.cn",nocase; classtype:attempted-recon; sid:200005426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.wigowu.cn",nocase; classtype:attempted-recon; sid:200005427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.wineyeliu.cn",nocase; classtype:attempted-recon; sid:200005428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.wwuyvee.top",nocase; classtype:attempted-recon; sid:200005429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.xdhcxx.cn",nocase; classtype:attempted-recon; sid:200005430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.yflw6056k3.cn",nocase; classtype:attempted-recon; sid:200005431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.yn865f8.cn",nocase; classtype:attempted-recon; sid:200005432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.yzdcpt.cn",nocase; classtype:attempted-recon; sid:200005433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.zjugmc.work",nocase; classtype:attempted-recon; sid:200005434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server.zkyonline.cn",nocase; classtype:attempted-recon; sid:200005435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server0012.byethost12.com",nocase; classtype:attempted-recon; sid:200005436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server003.byethost7.com",nocase; classtype:attempted-recon; sid:200005437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serverexpres0013.byethost12.com",nocase; classtype:attempted-recon; sid:200005438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servernuovaintesa.com",nocase; classtype:attempted-recon; sid:200005439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serversonline.i.ng",nocase; classtype:attempted-recon; sid:200005440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serverupdate.getforge.io",nocase; classtype:attempted-recon; sid:200005441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servi.cloudns.ph",nocase; classtype:attempted-recon; sid:200005442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servic.cloudns.ph",nocase; classtype:attempted-recon; sid:200005443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicabbout.blogspot.com",nocase; classtype:attempted-recon; sid:200005444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-client00-my-cheetah-website.free.builderall.com",nocase; classtype:attempted-recon; sid:200005445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-lkdn2020.gacconstrutora.com.br",nocase; classtype:attempted-recon; sid:200005446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-mailsfr.yolasite.com",nocase; classtype:attempted-recon; sid:200005447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service.swiss.post.ch.trustglobals.com",nocase; classtype:attempted-recon; sid:200005448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviceclient.site44.com",nocase; classtype:attempted-recon; sid:200005449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicepage.service-page.workers.dev",nocase; classtype:attempted-recon; sid:200005450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services-vodafone.com",nocase; classtype:attempted-recon; sid:200005451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-mss-forum.totalh.net",nocase; classtype:attempted-recon; sid:200005452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200005453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200005454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-rsa.ru",nocase; classtype:attempted-recon; sid:200005455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-vc.ru",nocase; classtype:attempted-recon; sid:200005456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200005457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-oq.xyz",nocase; classtype:attempted-recon; sid:200005458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesbanpichi.ihostfull.com",nocase; classtype:attempted-recon; sid:200005459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesclients.com.51543773-28-20210523142343.webstarterz.com",nocase; classtype:attempted-recon; sid:200005460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesonline23.byethost7.com",nocase; classtype:attempted-recon; sid:200005461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicetermopanebucuresti.ro",nocase; classtype:attempted-recon; sid:200005462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviceupdateconfirmation.com",nocase; classtype:attempted-recon; sid:200005463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicioalclientecitas.com",nocase; classtype:attempted-recon; sid:200005464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciosbndigitales.com",nocase; classtype:attempted-recon; sid:200005465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciosenlineasbn.com",nocase; classtype:attempted-recon; sid:200005466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servics.validationsecuradm.workers.dev",nocase; classtype:attempted-recon; sid:200005467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidopichincha.byethost31.com",nocase; classtype:attempted-recon; sid:200005468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor00006.byethost9.com",nocase; classtype:attempted-recon; sid:200005469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor00016.byethost11.com",nocase; classtype:attempted-recon; sid:200005470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor0010.byethost11.com",nocase; classtype:attempted-recon; sid:200005471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziapponline.com",nocase; classtype:attempted-recon; sid:200005472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servweb.cf",nocase; classtype:attempted-recon; sid:200005473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setona.main.jp",nocase; classtype:attempted-recon; sid:200005474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settingsandprivacy.gq",nocase; classtype:attempted-recon; sid:200005475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settlementsclaimz.com",nocase; classtype:attempted-recon; sid:200005476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setupmynorton.square.site",nocase; classtype:attempted-recon; sid:200005477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sevicemailbasic.dynv6.net",nocase; classtype:attempted-recon; sid:200005478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sevoudryserviciobomail.dudaone.com",nocase; classtype:attempted-recon; sid:200005479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seyuel.com",nocase; classtype:attempted-recon; sid:200005480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfc.com.vn",nocase; classtype:attempted-recon; sid:200005481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfr-mail162.yolasite.com",nocase; classtype:attempted-recon; sid:200005482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfrpanel.lws.fr",nocase; classtype:attempted-recon; sid:200005483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfsfsfvvvvv.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sftp.usin.com",nocase; classtype:attempted-recon; sid:200005485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgb-pageonline-original.com",nocase; classtype:attempted-recon; sid:200005486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgtbalde991-dot-still-dynamics-321006.ue.r.appspot.com",nocase; classtype:attempted-recon; sid:200005487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sh199811.website.pl",nocase; classtype:attempted-recon; sid:200005488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shamajastore.co.ke",nocase; classtype:attempted-recon; sid:200005489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanedrk.com",nocase; classtype:attempted-recon; sid:200005490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanestrailertraining.com",nocase; classtype:attempted-recon; sid:200005491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanky0.github.io",nocase; classtype:attempted-recon; sid:200005492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanwei58.cn",nocase; classtype:attempted-recon; sid:200005493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanza.epos.com.pk",nocase; classtype:attempted-recon; sid:200005494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-eu1.hsforms.com",nocase; classtype:attempted-recon; sid:200005495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-net-burundi.org",nocase; classtype:attempted-recon; sid:200005496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-relations.de",nocase; classtype:attempted-recon; sid:200005497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.chamaileon.io",nocase; classtype:attempted-recon; sid:200005498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shared-file.square.site",nocase; classtype:attempted-recon; sid:200005499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharedfax815201376.wordpress.com",nocase; classtype:attempted-recon; sid:200005500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharefiles.app.link",nocase; classtype:attempted-recon; sid:200005501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharelink.sn.am",nocase; classtype:attempted-recon; sid:200005502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharp-chebyshev.79-110-52-138.plesk.page",nocase; classtype:attempted-recon; sid:200005503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shiba-box.ltd",nocase; classtype:attempted-recon; sid:200005504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shibolim.net",nocase; classtype:attempted-recon; sid:200005505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shimamurakoutaro.com",nocase; classtype:attempted-recon; sid:200005506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shinobi163.com",nocase; classtype:attempted-recon; sid:200005507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shinobyx.com",nocase; classtype:attempted-recon; sid:200005508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.cmfurnituremall.com",nocase; classtype:attempted-recon; sid:200005509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.prunescape.com.au",nocase; classtype:attempted-recon; sid:200005510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopdekhoo.com",nocase; classtype:attempted-recon; sid:200005511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopee.khogiaodien247.com",nocase; classtype:attempted-recon; sid:200005512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopee688.com",nocase; classtype:attempted-recon; sid:200005513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopifystor.com",nocase; classtype:attempted-recon; sid:200005514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopmanfgeieooe-977a59.ingress-bonde.easywp.com",nocase; classtype:attempted-recon; sid:200005515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"short.npru.ac.th",nocase; classtype:attempted-recon; sid:200005516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shortenlink.top",nocase; classtype:attempted-recon; sid:200005517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shovalimyoqneam.co.il",nocase; classtype:attempted-recon; sid:200005518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"showcomputer.com",nocase; classtype:attempted-recon; sid:200005519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shservidores04.com.br",nocase; classtype:attempted-recon; sid:200005520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shtfrrty.com",nocase; classtype:attempted-recon; sid:200005521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shtuchki.store",nocase; classtype:attempted-recon; sid:200005522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siambc.com",nocase; classtype:attempted-recon; sid:200005523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheit-geht-nunmal-vor.xyz",nocase; classtype:attempted-recon; sid:200005524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheit-gewaehrleisten.xyz",nocase; classtype:attempted-recon; sid:200005525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheit-spk-psd2.de",nocase; classtype:attempted-recon; sid:200005526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheits-support-spk.com",nocase; classtype:attempted-recon; sid:200005527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurezzawebonline-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200005528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurr-mtb.com",nocase; classtype:attempted-recon; sid:200005529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurty-login.com",nocase; classtype:attempted-recon; sid:200005530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siduhi.com",nocase; classtype:attempted-recon; sid:200005531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siemik.github.io",nocase; classtype:attempted-recon; sid:200005532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sighing.servemp3.com",nocase; classtype:attempted-recon; sid:200005533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signature-notes.com",nocase; classtype:attempted-recon; sid:200005534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin-payeer.com",nocase; classtype:attempted-recon; sid:200005535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.ebay.de.whyymedia.com.au",nocase; classtype:attempted-recon; sid:200005536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dllsignin.usingssl.4q9rttcl7hccgbttjiuzyetvhlaac.amountsw.xyz",nocase; classtype:attempted-recon; sid:200005537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signintokrakenwelcome.xyz",nocase; classtype:attempted-recon; sid:200005538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signmaxxgh.com",nocase; classtype:attempted-recon; sid:200005539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signsmails.cloudns.ph",nocase; classtype:attempted-recon; sid:200005540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signyahoo0077.weebly.com",nocase; classtype:attempted-recon; sid:200005541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siida-disperindag.kalbarprov.go.id",nocase; classtype:attempted-recon; sid:200005542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sikkerhet.life",nocase; classtype:attempted-recon; sid:200005543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siklus.net",nocase; classtype:attempted-recon; sid:200005544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sil2.duerr-haustechnik.de",nocase; classtype:attempted-recon; sid:200005545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"silayan.sappk.itb.ac.id",nocase; classtype:attempted-recon; sid:200005546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sillyabba.com",nocase; classtype:attempted-recon; sid:200005547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simplehostsetup.com",nocase; classtype:attempted-recon; sid:200005548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simpletec.cl",nocase; classtype:attempted-recon; sid:200005549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simportusing.co.vu",nocase; classtype:attempted-recon; sid:200005550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simular.credfaciljb.com.br",nocase; classtype:attempted-recon; sid:200005551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sindarspen.org.br",nocase; classtype:attempted-recon; sid:200005552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sios.tech",nocase; classtype:attempted-recon; sid:200005553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siphen.com",nocase; classtype:attempted-recon; sid:200005554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siporados15585.blogspot.com",nocase; classtype:attempted-recon; sid:200005555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirak.se",nocase; classtype:attempted-recon; sid:200005556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirdarnell.org",nocase; classtype:attempted-recon; sid:200005557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site-4403463-3995-6112.mystrikingly.com",nocase; classtype:attempted-recon; sid:200005558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423623.92.webydo.com",nocase; classtype:attempted-recon; sid:200005559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423773.92.webydo.com",nocase; classtype:attempted-recon; sid:200005560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9434107.92.webydo.com",nocase; classtype:attempted-recon; sid:200005561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9548676.92.webydo.com",nocase; classtype:attempted-recon; sid:200005562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9551459.92.webydo.com",nocase; classtype:attempted-recon; sid:200005563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9552191.92.webydo.com",nocase; classtype:attempted-recon; sid:200005564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9605282.92.webydo.com",nocase; classtype:attempted-recon; sid:200005565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder130038.dynadot.com",nocase; classtype:attempted-recon; sid:200005566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder135844.dynadot.com",nocase; classtype:attempted-recon; sid:200005567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder138648.dynadot.com",nocase; classtype:attempted-recon; sid:200005568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder140483.dynadot.com",nocase; classtype:attempted-recon; sid:200005569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder140489.dynadot.com",nocase; classtype:attempted-recon; sid:200005570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder142839.dynadot.com",nocase; classtype:attempted-recon; sid:200005571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder144047.dynadot.com",nocase; classtype:attempted-recon; sid:200005572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder144957.dynadot.com",nocase; classtype:attempted-recon; sid:200005573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder148366.dynadot.com",nocase; classtype:attempted-recon; sid:200005574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-facebook-resmi21.webnode.com",nocase; classtype:attempted-recon; sid:200005575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-pemulihan-resmi0.webnode.com",nocase; classtype:attempted-recon; sid:200005576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sixlincolns.com",nocase; classtype:attempted-recon; sid:200005577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sjdncurrently.weebly.com",nocase; classtype:attempted-recon; sid:200005578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skade.gg",nocase; classtype:attempted-recon; sid:200005579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ski-dxb.com",nocase; classtype:attempted-recon; sid:200005580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinbarontow.ml",nocase; classtype:attempted-recon; sid:200005581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinpl.hostfree.pw",nocase; classtype:attempted-recon; sid:200005582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolp.hostfree.pw",nocase; classtype:attempted-recon; sid:200005583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolpler1.hostfree.pw",nocase; classtype:attempted-recon; sid:200005584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolpsv.hostfree.pw",nocase; classtype:attempted-recon; sid:200005585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinwallet.eu",nocase; classtype:attempted-recon; sid:200005586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sklad-hub.ru",nocase; classtype:attempted-recon; sid:200005587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sklepkody.pl",nocase; classtype:attempted-recon; sid:200005588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skradvanidance.business.site",nocase; classtype:attempted-recon; sid:200005589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skygobank.com",nocase; classtype:attempted-recon; sid:200005590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavis.solutions",nocase; classtype:attempted-recon; sid:200005591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavissupport.com",nocase; classtype:attempted-recon; sid:200005592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slavamel.github.io",nocase; classtype:attempted-recon; sid:200005593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sleepmaskz.com",nocase; classtype:attempted-recon; sid:200005594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slickparties.com",nocase; classtype:attempted-recon; sid:200005595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slmplenewforward.byethost31.com",nocase; classtype:attempted-recon; sid:200005596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sloka.constantcontactsites.com",nocase; classtype:attempted-recon; sid:200005597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slot-888.com",nocase; classtype:attempted-recon; sid:200005598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slovenska-posta.co.sk.u1478897.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200005599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slovenska8.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200005600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slowlinebag.jp",nocase; classtype:attempted-recon; sid:200005601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slql.byethost7.com",nocase; classtype:attempted-recon; sid:200005602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sm777.csb.app",nocase; classtype:attempted-recon; sid:200005603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"small-tooth-a6b5.888ae01263f6900531fcc79d131bf8191a901fa7.workers.dev",nocase; classtype:attempted-recon; sid:200005604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartcaboverde.com",nocase; classtype:attempted-recon; sid:200005605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smarteconomy.rs",nocase; classtype:attempted-recon; sid:200005606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartgos.com",nocase; classtype:attempted-recon; sid:200005607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartmco.com",nocase; classtype:attempted-recon; sid:200005608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartsparksolutions.com",nocase; classtype:attempted-recon; sid:200005609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smashpc.org",nocase; classtype:attempted-recon; sid:200005610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.air-water.com.cn",nocase; classtype:attempted-recon; sid:200005611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.edi01.com.cn",nocase; classtype:attempted-recon; sid:200005612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.fc100.com.cn",nocase; classtype:attempted-recon; sid:200005613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.gdzbi.com.cn",nocase; classtype:attempted-recon; sid:200005614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.ljzjzx.com.cn",nocase; classtype:attempted-recon; sid:200005615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.mdf-hotel.com.cn",nocase; classtype:attempted-recon; sid:200005616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.nfrkj2.com.cn",nocase; classtype:attempted-recon; sid:200005617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.ystdqczl.com.cn",nocase; classtype:attempted-recon; sid:200005618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad-con.yulegame.com.cn",nocase; classtype:attempted-recon; sid:200005619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad.com.ip.527xiyan.com.cn",nocase; classtype:attempted-recon; sid:200005620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad.com.ip.rgjinsheng.com.cn",nocase; classtype:attempted-recon; sid:200005621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-crad.com.ip.zenipower.com.cn",nocase; classtype:attempted-recon; sid:200005622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-jp.site",nocase; classtype:attempted-recon; sid:200005623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-login.co",nocase; classtype:attempted-recon; sid:200005624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-support.com",nocase; classtype:attempted-recon; sid:200005625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cade-co.net",nocase; classtype:attempted-recon; sid:200005626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.caed-ne.jp",nocase; classtype:attempted-recon; sid:200005627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.caed-ne.net",nocase; classtype:attempted-recon; sid:200005628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.carde-co.com",nocase; classtype:attempted-recon; sid:200005629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardn-co.com",nocase; classtype:attempted-recon; sid:200005630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardr-co.net",nocase; classtype:attempted-recon; sid:200005631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cards-ne.jp",nocase; classtype:attempted-recon; sid:200005632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cards-ne.net",nocase; classtype:attempted-recon; sid:200005633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardu-co.jp",nocase; classtype:attempted-recon; sid:200005634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardu-co.net",nocase; classtype:attempted-recon; sid:200005635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardz-co.com",nocase; classtype:attempted-recon; sid:200005636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cardz-co.net",nocase; classtype:attempted-recon; sid:200005637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cbrd-co.com",nocase; classtype:attempted-recon; sid:200005638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cbrd-co.jp",nocase; classtype:attempted-recon; sid:200005639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cbrd-co.net",nocase; classtype:attempted-recon; sid:200005640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cead-ne.com",nocase; classtype:attempted-recon; sid:200005641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cead-ne.jp",nocase; classtype:attempted-recon; sid:200005642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cead-ne.net",nocase; classtype:attempted-recon; sid:200005643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.ceard-co.com",nocase; classtype:attempted-recon; sid:200005644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.ceard-co.jp",nocase; classtype:attempted-recon; sid:200005645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.ceard-co.net",nocase; classtype:attempted-recon; sid:200005646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cgrd-co.jp",nocase; classtype:attempted-recon; sid:200005647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.co.jp.kkxxlv.com",nocase; classtype:attempted-recon; sid:200005648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.csad-co.com",nocase; classtype:attempted-recon; sid:200005649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.ctad-co.com",nocase; classtype:attempted-recon; sid:200005650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.czrd-co.com",nocase; classtype:attempted-recon; sid:200005651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.czrd-co.jp",nocase; classtype:attempted-recon; sid:200005652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.xard-co.com",nocase; classtype:attempted-recon; sid:200005653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.xard-co.jp",nocase; classtype:attempted-recon; sid:200005654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.xard-co.net",nocase; classtype:attempted-recon; sid:200005655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcc.co.jjp.edenproductions.net",nocase; classtype:attempted-recon; sid:200005656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcc.co.jjp.feldarbeit.net",nocase; classtype:attempted-recon; sid:200005657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcc.co.jjp.gyjscx.net",nocase; classtype:attempted-recon; sid:200005658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcc.co.jjp.szexjatekok.net",nocase; classtype:attempted-recon; sid:200005659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcwodeqingguoshoujicojp.top",nocase; classtype:attempted-recon; sid:200005660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbv.co.jp.rtihnmsan.xyz",nocase; classtype:attempted-recon; sid:200005661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smcbcconfig.com",nocase; classtype:attempted-recon; sid:200005662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smeo.org.mx",nocase; classtype:attempted-recon; sid:200005663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smetracking.com",nocase; classtype:attempted-recon; sid:200005664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smgolamalif.github.io",nocase; classtype:attempted-recon; sid:200005665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smile-etc.jp",nocase; classtype:attempted-recon; sid:200005666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smkkesehatanjember.sch.id",nocase; classtype:attempted-recon; sid:200005667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smmsvocal.yolasite.com",nocase; classtype:attempted-recon; sid:200005668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smoc.co.jp.gimeyi.xyz",nocase; classtype:attempted-recon; sid:200005669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smoc.co.jp.nbruaqsi.xyz",nocase; classtype:attempted-recon; sid:200005670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sms-shorter.com",nocase; classtype:attempted-recon; sid:200005671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smscaixanovo.blogspot.com",nocase; classtype:attempted-recon; sid:200005672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsenligne.myfreesites.net",nocase; classtype:attempted-recon; sid:200005673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangephonemail.myfreesites.net",nocase; classtype:attempted-recon; sid:200005674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangesmsmessage.myfreesites.net",nocase; classtype:attempted-recon; sid:200005675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smss-mms.yolasite.com",nocase; classtype:attempted-recon; sid:200005676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsverificationmms.myfreesites.net",nocase; classtype:attempted-recon; sid:200005677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smuo.co.jp.sdkriner.top",nocase; classtype:attempted-recon; sid:200005678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snajhyssssssssss.byethost31.com",nocase; classtype:attempted-recon; sid:200005679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sniter.widyakartika.ac.id",nocase; classtype:attempted-recon; sid:200005680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snprobbx.pbz.r.uk.a2ip.ru",nocase; classtype:attempted-recon; sid:200005681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snrsystem.com",nocase; classtype:attempted-recon; sid:200005682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sntuyconfgurtion.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soaringskiesrentals.com",nocase; classtype:attempted-recon; sid:200005684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sobisparkss-poser.blogspot.com",nocase; classtype:attempted-recon; sid:200005685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soci-molen.web.app",nocase; classtype:attempted-recon; sid:200005686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"socialpinch.com",nocase; classtype:attempted-recon; sid:200005687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sofe-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soft-cell-8148.updateloginprogram.workers.dev",nocase; classtype:attempted-recon; sid:200005689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soft-shadow-fa4c.mywnewdhlupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200005690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"softclump.com",nocase; classtype:attempted-recon; sid:200005691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"software.verify-secure.info",nocase; classtype:attempted-recon; sid:200005692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sognointerno.com",nocase; classtype:attempted-recon; sid:200005693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solana.to",nocase; classtype:attempted-recon; sid:200005694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solanasforum.com",nocase; classtype:attempted-recon; sid:200005695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soldierofthecross.us",nocase; classtype:attempted-recon; sid:200005696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solicitarfirmaelectronica-sv.com",nocase; classtype:attempted-recon; sid:200005697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solitary-flower-7e0a.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200005698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionunlock.com",nocase; classtype:attempted-recon; sid:200005699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solyanayakomnata.ru",nocase; classtype:attempted-recon; sid:200005700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soneyamks.com",nocase; classtype:attempted-recon; sid:200005701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sonigthe-2020.byethost8.com",nocase; classtype:attempted-recon; sid:200005702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sonofabridge.com.net2care.com",nocase; classtype:attempted-recon; sid:200005703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sopac.org.py",nocase; classtype:attempted-recon; sid:200005704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soracoes.xyz",nocase; classtype:attempted-recon; sid:200005705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sorowhite53.byethost6.com",nocase; classtype:attempted-recon; sid:200005706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sorrow.servepics.com",nocase; classtype:attempted-recon; sid:200005707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sotly.me",nocase; classtype:attempted-recon; sid:200005708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souaxwaoh.myfreesites.net",nocase; classtype:attempted-recon; sid:200005709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soubanri.com",nocase; classtype:attempted-recon; sid:200005710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soude-masi.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souk04.atempurl.com",nocase; classtype:attempted-recon; sid:200005712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souravtech.com",nocase; classtype:attempted-recon; sid:200005713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southamerica-east1-noted-minutia-330211.cloudfunctions.net",nocase; classtype:attempted-recon; sid:200005714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southlanddental.com.au",nocase; classtype:attempted-recon; sid:200005715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southport-farm-holidays.co.uk",nocase; classtype:attempted-recon; sid:200005716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soysodimac.estudiarfacil.com",nocase; classtype:attempted-recon; sid:200005717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp-kassen-rot.xyz",nocase; classtype:attempted-recon; sid:200005718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp477389.sitebeat.site",nocase; classtype:attempted-recon; sid:200005719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp701876.sitebeat.site",nocase; classtype:attempted-recon; sid:200005720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spar-kassendatenabteilung.com",nocase; classtype:attempted-recon; sid:200005721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spark.shaheenwrites.com",nocase; classtype:attempted-recon; sid:200005722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-pushapp.de",nocase; classtype:attempted-recon; sid:200005723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-pushtan.de",nocase; classtype:attempted-recon; sid:200005724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-1129.de",nocase; classtype:attempted-recon; sid:200005725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-finanzportalupdate.com",nocase; classtype:attempted-recon; sid:200005726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-hannover.work",nocase; classtype:attempted-recon; sid:200005727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-kundenbetreuung.de",nocase; classtype:attempted-recon; sid:200005728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-kundensicherheit.de",nocase; classtype:attempted-recon; sid:200005729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-push.de",nocase; classtype:attempted-recon; sid:200005730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-pushwartung.de",nocase; classtype:attempted-recon; sid:200005731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-sicherheit-com.de",nocase; classtype:attempted-recon; sid:200005732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de-privatkunden-online-23455436543.net",nocase; classtype:attempted-recon; sid:200005733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de-privatkunden-online-34523256675.com",nocase; classtype:attempted-recon; sid:200005734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de-privatkunden-online-34545365476.com",nocase; classtype:attempted-recon; sid:200005735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de-privatkunden-online-37824893249.net",nocase; classtype:attempted-recon; sid:200005736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de-verbinden-sicherer.xyz",nocase; classtype:attempted-recon; sid:200005737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-gruppe-de-update.com",nocase; classtype:attempted-recon; sid:200005738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-home-system.com",nocase; classtype:attempted-recon; sid:200005739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-veri-online-2021.xyz",nocase; classtype:attempted-recon; sid:200005740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassengruppe-girologin-center.com",nocase; classtype:attempted-recon; sid:200005741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassengruppe-observices.com",nocase; classtype:attempted-recon; sid:200005742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassengruppewebidcheck.com",nocase; classtype:attempted-recon; sid:200005743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassenlogin-validierung.com",nocase; classtype:attempted-recon; sid:200005744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkling-leaf-edc6.reseltz101.workers.dev",nocase; classtype:attempted-recon; sid:200005745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparxinteriors.co.zw",nocase; classtype:attempted-recon; sid:200005746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectralwirejewelry.com",nocase; classtype:attempted-recon; sid:200005747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectreindia.co",nocase; classtype:attempted-recon; sid:200005748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectrumstorageaccess.yahoosites.com",nocase; classtype:attempted-recon; sid:200005749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"speedylogisticsllc.com",nocase; classtype:attempted-recon; sid:200005750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spela.svenskaspel.se",nocase; classtype:attempted-recon; sid:200005751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spentamultimedia.com",nocase; classtype:attempted-recon; sid:200005752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spidertvapp.com",nocase; classtype:attempted-recon; sid:200005753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spinosacenter.com",nocase; classtype:attempted-recon; sid:200005754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spiritotarsogno.com",nocase; classtype:attempted-recon; sid:200005755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-angleichung.top",nocase; classtype:attempted-recon; sid:200005756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-angleichungsverfahren.top",nocase; classtype:attempted-recon; sid:200005757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-chip.com",nocase; classtype:attempted-recon; sid:200005758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-dataportal.com",nocase; classtype:attempted-recon; sid:200005759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-daten-manager.com",nocase; classtype:attempted-recon; sid:200005760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenabgleich.top",nocase; classtype:attempted-recon; sid:200005761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanager.com",nocase; classtype:attempted-recon; sid:200005762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenschutz-konform.xyz",nocase; classtype:attempted-recon; sid:200005763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenschutz.com",nocase; classtype:attempted-recon; sid:200005764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datensicherung.top",nocase; classtype:attempted-recon; sid:200005765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-deportallogchecker.com",nocase; classtype:attempted-recon; sid:200005766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-erneuerungs-manager.com",nocase; classtype:attempted-recon; sid:200005767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-erneuerungsmanager.com",nocase; classtype:attempted-recon; sid:200005768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-eudatenbestimmung.com",nocase; classtype:attempted-recon; sid:200005769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-fin-portal.com",nocase; classtype:attempted-recon; sid:200005770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-finanzportal-login-de.com",nocase; classtype:attempted-recon; sid:200005771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-home-online-finanzportal.com",nocase; classtype:attempted-recon; sid:200005772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-home-onlinefinanzportal.com",nocase; classtype:attempted-recon; sid:200005773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0871.top",nocase; classtype:attempted-recon; sid:200005774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0872.top",nocase; classtype:attempted-recon; sid:200005775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0873.top",nocase; classtype:attempted-recon; sid:200005776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0874.top",nocase; classtype:attempted-recon; sid:200005777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0875.top",nocase; classtype:attempted-recon; sid:200005778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id087955.top",nocase; classtype:attempted-recon; sid:200005779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879551.top",nocase; classtype:attempted-recon; sid:200005780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879552.top",nocase; classtype:attempted-recon; sid:200005781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879554.top",nocase; classtype:attempted-recon; sid:200005782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879555.top",nocase; classtype:attempted-recon; sid:200005783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879556.top",nocase; classtype:attempted-recon; sid:200005784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id0879578.top",nocase; classtype:attempted-recon; sid:200005785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id11123.top",nocase; classtype:attempted-recon; sid:200005786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id4324235345.top",nocase; classtype:attempted-recon; sid:200005787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id4455.tech",nocase; classtype:attempted-recon; sid:200005788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id523465234.top",nocase; classtype:attempted-recon; sid:200005789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id63472322.tech",nocase; classtype:attempted-recon; sid:200005790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id78684.top",nocase; classtype:attempted-recon; sid:200005791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-id8657456.top",nocase; classtype:attempted-recon; sid:200005792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-konformer-datenschutz.xyz",nocase; classtype:attempted-recon; sid:200005793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-kundensystem.top",nocase; classtype:attempted-recon; sid:200005794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-kundensysteme.top",nocase; classtype:attempted-recon; sid:200005795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-kundenumstellung.top",nocase; classtype:attempted-recon; sid:200005796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-kundenzertifizierung.top",nocase; classtype:attempted-recon; sid:200005797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-livesystem.com",nocase; classtype:attempted-recon; sid:200005798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-ob-center-sparkassengruppe.com",nocase; classtype:attempted-recon; sid:200005799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-obfreigabeportal.com",nocase; classtype:attempted-recon; sid:200005800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-online-home.com",nocase; classtype:attempted-recon; sid:200005801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-online-homeservices.com",nocase; classtype:attempted-recon; sid:200005802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-onlineservicederspk.com",nocase; classtype:attempted-recon; sid:200005803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-pibs-aktivierung.com",nocase; classtype:attempted-recon; sid:200005804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-pibs-aktivierung.info",nocase; classtype:attempted-recon; sid:200005805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-pibs-aktivierung.org",nocase; classtype:attempted-recon; sid:200005806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-portal.com",nocase; classtype:attempted-recon; sid:200005807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-servicesystem.top",nocase; classtype:attempted-recon; sid:200005808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-servicezertifizierung.top",nocase; classtype:attempted-recon; sid:200005809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicher-direkt-2021.xyz",nocase; classtype:attempted-recon; sid:200005810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheits-center-gruppe.com",nocase; classtype:attempted-recon; sid:200005811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungsservice.top",nocase; classtype:attempted-recon; sid:200005812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungssystem.top",nocase; classtype:attempted-recon; sid:200005813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungssysteme.top",nocase; classtype:attempted-recon; sid:200005814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-system-manager.com",nocase; classtype:attempted-recon; sid:200005815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-systemmanager.com",nocase; classtype:attempted-recon; sid:200005816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-systems-update.com",nocase; classtype:attempted-recon; sid:200005817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-systemzertifizierung.top",nocase; classtype:attempted-recon; sid:200005818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-tanverfahren.de",nocase; classtype:attempted-recon; sid:200005819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungs-manager.com",nocase; classtype:attempted-recon; sid:200005820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungsmanager.com",nocase; classtype:attempted-recon; sid:200005821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-update-version.top",nocase; classtype:attempted-recon; sid:200005822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-update-version2.top",nocase; classtype:attempted-recon; sid:200005823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-update-version3.top",nocase; classtype:attempted-recon; sid:200005824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-zertifikat29498.top",nocase; classtype:attempted-recon; sid:200005825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-zertifikat98219.top",nocase; classtype:attempted-recon; sid:200005826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-zertifizierung.top",nocase; classtype:attempted-recon; sid:200005827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-zertifizierungen.top",nocase; classtype:attempted-recon; sid:200005828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-zertifizierungszentrale.top",nocase; classtype:attempted-recon; sid:200005829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkfinanzgruppe-log-update.com",nocase; classtype:attempted-recon; sid:200005830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkhomeservice.com",nocase; classtype:attempted-recon; sid:200005831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkidservice.com",nocase; classtype:attempted-recon; sid:200005832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkitem7.life",nocase; classtype:attempted-recon; sid:200005833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkonlineumstellung.com",nocase; classtype:attempted-recon; sid:200005834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sponsorlens.cs.umn.edu",nocase; classtype:attempted-recon; sid:200005835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spontan.ch.net2care.com",nocase; classtype:attempted-recon; sid:200005836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spookysvvap.finance",nocase; classtype:attempted-recon; sid:200005837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spookyswep.financial",nocase; classtype:attempted-recon; sid:200005838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sport.protected-secur.workers.dev",nocase; classtype:attempted-recon; sid:200005839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spotify-home.com",nocase; classtype:attempted-recon; sid:200005840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spotlfy-subscribe.com",nocase; classtype:attempted-recon; sid:200005841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spp2.gratishosting.cl",nocase; classtype:attempted-recon; sid:200005842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spring-pond-62c4.autocreative.workers.dev",nocase; classtype:attempted-recon; sid:200005843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spring-pond-62c4.autocreative.workers.dev#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200005844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sprk-secure-ban.xyz",nocase; classtype:attempted-recon; sid:200005845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spropes-auntmillies-com.slite.com",nocase; classtype:attempted-recon; sid:200005846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sprtcnicomicrsf.byethost17.com",nocase; classtype:attempted-recon; sid:200005847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sprw.io",nocase; classtype:attempted-recon; sid:200005848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squirdddd.square.site",nocase; classtype:attempted-recon; sid:200005849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srfgzdsfh4ergdsfg.agilecrm.com",nocase; classtype:attempted-recon; sid:200005850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srilakshmiengg.com",nocase; classtype:attempted-recon; sid:200005851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srisritextiles.com",nocase; classtype:attempted-recon; sid:200005852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.3wq87d.cn",nocase; classtype:attempted-recon; sid:200005853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.9ncgjz.cn",nocase; classtype:attempted-recon; sid:200005854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.knhov0.cn",nocase; classtype:attempted-recon; sid:200005855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.kombus.cn",nocase; classtype:attempted-recon; sid:200005856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.krjoodvo.cn",nocase; classtype:attempted-recon; sid:200005857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.kvgkvpkk.cn",nocase; classtype:attempted-recon; sid:200005858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.luqkrpc.cn",nocase; classtype:attempted-recon; sid:200005859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.m6z0tq.cn",nocase; classtype:attempted-recon; sid:200005860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.mkiqoyie.cn",nocase; classtype:attempted-recon; sid:200005861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.mqiabean.cn",nocase; classtype:attempted-recon; sid:200005862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.msovf6.cn",nocase; classtype:attempted-recon; sid:200005863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.n4hsqu.cn",nocase; classtype:attempted-recon; sid:200005864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.n8072b.cn",nocase; classtype:attempted-recon; sid:200005865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srvr-cloudmail-srvr5s5wd3.pages.dev",nocase; classtype:attempted-recon; sid:200005866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssdjowe.top",nocase; classtype:attempted-recon; sid:200005867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssia.org.sg",nocase; classtype:attempted-recon; sid:200005868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssl-cloud-r.s4-cloud980-0.workers.dev",nocase; classtype:attempted-recon; sid:200005869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vi.com",nocase; classtype:attempted-recon; sid:200005870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vn.com",nocase; classtype:attempted-recon; sid:200005871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena.com",nocase; classtype:attempted-recon; sid:200005872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssw-sued05.xyz",nocase; classtype:attempted-recon; sid:200005873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sswebmail-4w5twsr.web.app",nocase; classtype:attempted-recon; sid:200005874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staging.eliteautomotive.com.au",nocase; classtype:attempted-recon; sid:200005875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staratlas.exchange",nocase; classtype:attempted-recon; sid:200005876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stardirectingfr.projet-web.net",nocase; classtype:attempted-recon; sid:200005877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stargiveaway.com",nocase; classtype:attempted-recon; sid:200005878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starliker.net",nocase; classtype:attempted-recon; sid:200005879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starlingbankplc.com",nocase; classtype:attempted-recon; sid:200005880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starmak.com.tr",nocase; classtype:attempted-recon; sid:200005881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starp2.com",nocase; classtype:attempted-recon; sid:200005882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starsoftheindustry.com",nocase; classtype:attempted-recon; sid:200005883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"startseite-verden.de",nocase; classtype:attempted-recon; sid:200005884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starttsboxfile.myfreesites.net",nocase; classtype:attempted-recon; sid:200005885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stateagencybe.tumblr.com",nocase; classtype:attempted-recon; sid:200005886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static-ak-fbcdn.atspace.com",nocase; classtype:attempted-recon; sid:200005887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static-promote.weebly.com",nocase; classtype:attempted-recon; sid:200005888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"status-track-dispatch.com",nocase; classtype:attempted-recon; sid:200005889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stclarechurch.net",nocase; classtype:attempted-recon; sid:200005890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamcommunityx.com",nocase; classtype:attempted-recon; sid:200005891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steaminventorytrading.com",nocase; classtype:attempted-recon; sid:200005892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steammcommunity.ru.com",nocase; classtype:attempted-recon; sid:200005893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamproxy.net",nocase; classtype:attempted-recon; sid:200005894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steannconnunity.com",nocase; classtype:attempted-recon; sid:200005895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steep-wind-ce24.josephdelgado3790.workers.dev",nocase; classtype:attempted-recon; sid:200005896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenbutik.com",nocase; classtype:attempted-recon; sid:200005897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenshoe.net",nocase; classtype:attempted-recon; sid:200005898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenstivali.com",nocase; classtype:attempted-recon; sid:200005899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemadderomania.co",nocase; classtype:attempted-recon; sid:200005900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steven-coldwellbth9965.web.app",nocase; classtype:attempted-recon; sid:200005901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevencrews.com",nocase; classtype:attempted-recon; sid:200005902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stewarts-stupendous-project-ee8707.webflow.io",nocase; classtype:attempted-recon; sid:200005903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stgrp.ru",nocase; classtype:attempted-recon; sid:200005904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"still-math-4bfc.dhkupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200005905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"still-water-f10f.khun-shaedlive.workers.dev",nocase; classtype:attempted-recon; sid:200005906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stimulus-claim.com",nocase; classtype:attempted-recon; sid:200005907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stjudes.in",nocase; classtype:attempted-recon; sid:200005908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; classtype:attempted-recon; sid:200005909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stonehambank.cc",nocase; classtype:attempted-recon; sid:200005910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.yandexcloud.net",nocase; classtype:attempted-recon; sid:200005911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"store.prunescape.com.au",nocase; classtype:attempted-recon; sid:200005912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"streamlightmotionmedia.com",nocase; classtype:attempted-recon; sid:200005913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stretchbuilder.com",nocase; classtype:attempted-recon; sid:200005914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"strikevalue.org",nocase; classtype:attempted-recon; sid:200005915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stroidseccurre.co.vu",nocase; classtype:attempted-recon; sid:200005916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"strona-zaloguj-online.com",nocase; classtype:attempted-recon; sid:200005917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"students2science.org",nocase; classtype:attempted-recon; sid:200005918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stylesbyaranda.com",nocase; classtype:attempted-recon; sid:200005919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stylifehomedecors.com",nocase; classtype:attempted-recon; sid:200005920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suazupaprof.rf.gd",nocase; classtype:attempted-recon; sid:200005921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sub4sub.co",nocase; classtype:attempted-recon; sid:200005922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"subdomainnet1.byethost13.com",nocase; classtype:attempted-recon; sid:200005923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"successgroup.org",nocase; classtype:attempted-recon; sid:200005924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"succvirtl.com",nocase; classtype:attempted-recon; sid:200005925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalpersona-stransaccionesbancolombia.com",nocase; classtype:attempted-recon; sid:200005926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalpersona1.2host.me",nocase; classtype:attempted-recon; sid:200005927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalvirtualpersonas.transaccionesbancolombia-com.ru",nocase; classtype:attempted-recon; sid:200005928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursapersonastransacionebancolombiaccomn.small-business-solutions.biz",nocase; classtype:attempted-recon; sid:200005929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucuvirtcolba.com",nocase; classtype:attempted-recon; sid:200005930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sudamshelar.in",nocase; classtype:attempted-recon; sid:200005931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sudaworks.com",nocase; classtype:attempted-recon; sid:200005932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suelunn.com",nocase; classtype:attempted-recon; sid:200005933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suitsandfits.com.pk",nocase; classtype:attempted-recon; sid:200005934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suivi-cod2823999023.com",nocase; classtype:attempted-recon; sid:200005935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suiviticket.co",nocase; classtype:attempted-recon; sid:200005936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sukodono.sragen.pramukajateng.or.id",nocase; classtype:attempted-recon; sid:200005937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200005939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumbc-caridinfo.com",nocase; classtype:attempted-recon; sid:200005940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suminetconfir.hostfree.pw",nocase; classtype:attempted-recon; sid:200005941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumpandtankcleaners.in",nocase; classtype:attempted-recon; sid:200005942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunbeltmembers.com",nocase; classtype:attempted-recon; sid:200005943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunge-ode.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunsetslushdupage.com",nocase; classtype:attempted-recon; sid:200005945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suntmobilebanking.com",nocase; classtype:attempted-recon; sid:200005946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supcuttfree.byethost7.com",nocase; classtype:attempted-recon; sid:200005947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir12.blogspot.com",nocase; classtype:attempted-recon; sid:200005948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir2.blogspot.com",nocase; classtype:attempted-recon; sid:200005949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz3.blogspot.com",nocase; classtype:attempted-recon; sid:200005951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200005952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supermilhas.com",nocase; classtype:attempted-recon; sid:200005953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernet-santa-1.hostfree.pw",nocase; classtype:attempted-recon; sid:200005954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernettsd-worl.byethost22.com",nocase; classtype:attempted-recon; sid:200005955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernetx.byethost32.com",nocase; classtype:attempted-recon; sid:200005956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersantderft.byethost14.com",nocase; classtype:attempted-recon; sid:200005957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersantlogg.22web.org",nocase; classtype:attempted-recon; sid:200005958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportecxacesso2020.com",nocase; classtype:attempted-recon; sid:200005959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportsupernet.hostfree.pw",nocase; classtype:attempted-recon; sid:200005960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suppliers.bitshepherd.org",nocase; classtype:attempted-recon; sid:200005961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-att.com",nocase; classtype:attempted-recon; sid:200005962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-dz725u-league-of-legends.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-security.paypal.com.komamen.com",nocase; classtype:attempted-recon; sid:200005964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-verify-mydevices.com",nocase; classtype:attempted-recon; sid:200005965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supportmailbxo.creatorlink.net",nocase; classtype:attempted-recon; sid:200005966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supportwallet-axieinfinity.com",nocase; classtype:attempted-recon; sid:200005967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supremenet4555.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"susanlynnepeters.com",nocase; classtype:attempted-recon; sid:200005969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suspedpromericsv.hostfree.pw",nocase; classtype:attempted-recon; sid:200005970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suupernett.byethost4.com",nocase; classtype:attempted-recon; sid:200005971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suuupeernet.byethost7.com",nocase; classtype:attempted-recon; sid:200005972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sv.mikecrm.com",nocase; classtype:attempted-recon; sid:200005973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svdfcxe.web.app",nocase; classtype:attempted-recon; sid:200005974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svelte-kdy6dk.stackblitz.io",nocase; classtype:attempted-recon; sid:200005975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svetikc.space",nocase; classtype:attempted-recon; sid:200005976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svr-casloginsfrmail.ulanding.me",nocase; classtype:attempted-recon; sid:200005977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svri-my-mtb.com",nocase; classtype:attempted-recon; sid:200005978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svssol.com",nocase; classtype:attempted-recon; sid:200005979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swanholm.net",nocase; classtype:attempted-recon; sid:200005980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swanky.dvrlists.com",nocase; classtype:attempted-recon; sid:200005981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swap.elena.finance",nocase; classtype:attempted-recon; sid:200005982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swappauto.staging.lcsolutions.it",nocase; classtype:attempted-recon; sid:200005983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swbo.co.jp.yrmhwu.xyz",nocase; classtype:attempted-recon; sid:200005984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swiftbreakgroup.com",nocase; classtype:attempted-recon; sid:200005985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscom.myfreesites.net",nocase; classtype:attempted-recon; sid:200005986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swissibisbank.com",nocase; classtype:attempted-recon; sid:200005987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspost-delivering-parcel.trowelandfork.com",nocase; classtype:attempted-recon; sid:200005988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspost-tracking-parcel.serrver-ma.com",nocase; classtype:attempted-recon; sid:200005989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspost.editorafiel.pt",nocase; classtype:attempted-recon; sid:200005990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synaxisreadymix.com",nocase; classtype:attempted-recon; sid:200005991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syncwalletconnect.cloud",nocase; classtype:attempted-recon; sid:200005992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synergica.no",nocase; classtype:attempted-recon; sid:200005993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synoxpigments.com.br",nocase; classtype:attempted-recon; sid:200005994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syr.us",nocase; classtype:attempted-recon; sid:200005995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syromalabarbrisbanesouth.org.au",nocase; classtype:attempted-recon; sid:200005996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"system-logs-spk.com",nocase; classtype:attempted-recon; sid:200005997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"systemlog-spk.com",nocase; classtype:attempted-recon; sid:200005998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"systenver-coban.byethost7.com",nocase; classtype:attempted-recon; sid:200005999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"szfhz.cn",nocase; classtype:attempted-recon; sid:200006000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t-online-de.net",nocase; classtype:attempted-recon; sid:200006001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mails.total.direct-energie.com",nocase; classtype:attempted-recon; sid:200006002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mktla.com",nocase; classtype:attempted-recon; sid:200006003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t9y.me",nocase; classtype:attempted-recon; sid:200006004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taalim.ma",nocase; classtype:attempted-recon; sid:200006005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabaccheriadelborgo.net",nocase; classtype:attempted-recon; sid:200006006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabitapeixoto.com",nocase; classtype:attempted-recon; sid:200006007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabloided.com",nocase; classtype:attempted-recon; sid:200006008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tackon.rf.gd",nocase; classtype:attempted-recon; sid:200006009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tademydandp.com",nocase; classtype:attempted-recon; sid:200006010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tadriib.com",nocase; classtype:attempted-recon; sid:200006011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taher-mohamed-ahmed-saad.github.io",nocase; classtype:attempted-recon; sid:200006012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taijishentie.com",nocase; classtype:attempted-recon; sid:200006013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taiwokupolatiandco.com",nocase; classtype:attempted-recon; sid:200006014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takbyte-stockholm.se",nocase; classtype:attempted-recon; sid:200006015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takeyourpaylbc.com",nocase; classtype:attempted-recon; sid:200006016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takingnote.learningmatters.tv",nocase; classtype:attempted-recon; sid:200006017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takipcikazanvip.com",nocase; classtype:attempted-recon; sid:200006018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taktgroup.com",nocase; classtype:attempted-recon; sid:200006019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"talkingdogsmobile.com",nocase; classtype:attempted-recon; sid:200006020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamilnadutourstravels.com",nocase; classtype:attempted-recon; sid:200006021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamkein.com",nocase; classtype:attempted-recon; sid:200006022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tanbo.main.jp",nocase; classtype:attempted-recon; sid:200006023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tappingconnection.com",nocase; classtype:attempted-recon; sid:200006024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tarik-fitness.com",nocase; classtype:attempted-recon; sid:200006025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tasks.ileadco.com",nocase; classtype:attempted-recon; sid:200006026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taumiq.com",nocase; classtype:attempted-recon; sid:200006027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taxopus.com",nocase; classtype:attempted-recon; sid:200006028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tazawin2012.blogspot.com",nocase; classtype:attempted-recon; sid:200006029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tb915hdh89.mfs.gg",nocase; classtype:attempted-recon; sid:200006030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tbositescapecompany.com",nocase; classtype:attempted-recon; sid:200006031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tbs-meirugarl.servebeer.com",nocase; classtype:attempted-recon; sid:200006032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tby.eb-sites.com",nocase; classtype:attempted-recon; sid:200006033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcaconnect.ac-page.com",nocase; classtype:attempted-recon; sid:200006034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcso-chertanovo.ru",nocase; classtype:attempted-recon; sid:200006035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamgoogle125590.psee.ly",nocase; classtype:attempted-recon; sid:200006036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamidentitypagessupport.co.vu",nocase; classtype:attempted-recon; sid:200006037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teammetapp.azurefd.net",nocase; classtype:attempted-recon; sid:200006038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamshared.net.ru",nocase; classtype:attempted-recon; sid:200006039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tech4guru.com",nocase; classtype:attempted-recon; sid:200006040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techdirectbh.com",nocase; classtype:attempted-recon; sid:200006041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techservic001.byethost11.com",nocase; classtype:attempted-recon; sid:200006042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecnominproductos.com",nocase; classtype:attempted-recon; sid:200006043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teekitstorage.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200006044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telececreditobcp.com",nocase; classtype:attempted-recon; sid:200006045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telekom.mydisplayer.stream",nocase; classtype:attempted-recon; sid:200006046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telexaempresa.com",nocase; classtype:attempted-recon; sid:200006047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tellmeliu.github.io",nocase; classtype:attempted-recon; sid:200006048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tempatpinjamuang.co.id",nocase; classtype:attempted-recon; sid:200006049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"templat65sldh.myfreesites.net",nocase; classtype:attempted-recon; sid:200006050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"temporary-url.com",nocase; classtype:attempted-recon; sid:200006051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tenhoquarto.com",nocase; classtype:attempted-recon; sid:200006052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tenhoquarto.com.br",nocase; classtype:attempted-recon; sid:200006053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tenisclubemc.com.br",nocase; classtype:attempted-recon; sid:200006054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ternova-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200006055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terpelsicumple.com",nocase; classtype:attempted-recon; sid:200006056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terra-station-extention.com",nocase; classtype:attempted-recon; sid:200006057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terri2.gitlab.io",nocase; classtype:attempted-recon; sid:200006058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terrifiermerch.com",nocase; classtype:attempted-recon; sid:200006059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terygay.com",nocase; classtype:attempted-recon; sid:200006060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tesarstvi-glac.cz",nocase; classtype:attempted-recon; sid:200006061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tesltbig-95f268.ingress-daribow.easywp.com",nocase; classtype:attempted-recon; sid:200006062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.adicoder.com",nocase; classtype:attempted-recon; sid:200006063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.bayoucitybadges.org",nocase; classtype:attempted-recon; sid:200006064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.dxbproductions.com",nocase; classtype:attempted-recon; sid:200006065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.mediaclock.com.au",nocase; classtype:attempted-recon; sid:200006066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.prunescape.com.au",nocase; classtype:attempted-recon; sid:200006067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.webclient4.de",nocase; classtype:attempted-recon; sid:200006068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teste.listafood.com.br",nocase; classtype:attempted-recon; sid:200006069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"testingfortt-aj.com",nocase; classtype:attempted-recon; sid:200006070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"testingtmp.xyz",nocase; classtype:attempted-recon; sid:200006071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"testwebarif.duckdns.org",nocase; classtype:attempted-recon; sid:200006072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tex-xxt.weebly.com",nocase; classtype:attempted-recon; sid:200006073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"texasfreedomrun.com",nocase; classtype:attempted-recon; sid:200006074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tfp6rutys.000webhostapp.com",nocase; classtype:attempted-recon; sid:200006075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tg.pe",nocase; classtype:attempted-recon; sid:200006076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tgbhyu.hyperphp.com",nocase; classtype:attempted-recon; sid:200006077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tgpafasfsakkk.pages.dev",nocase; classtype:attempted-recon; sid:200006078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thdud-2536.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200006079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theaceofspaeder.com",nocase; classtype:attempted-recon; sid:200006080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebeachleague.com",nocase; classtype:attempted-recon; sid:200006081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebeetlelabs.com",nocase; classtype:attempted-recon; sid:200006082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebusinessprofitsystem.com",nocase; classtype:attempted-recon; sid:200006083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thecardyousaved.ingamazonstart.cyou",nocase; classtype:attempted-recon; sid:200006084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thecastlejo.com",nocase; classtype:attempted-recon; sid:200006085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thechillipicklecanteen.com",nocase; classtype:attempted-recon; sid:200006086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theculturewire.com",nocase; classtype:attempted-recon; sid:200006087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedom.kg",nocase; classtype:attempted-recon; sid:200006088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theduecfoinv.com",nocase; classtype:attempted-recon; sid:200006089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theepic.in",nocase; classtype:attempted-recon; sid:200006090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefeelingwhole.com",nocase; classtype:attempted-recon; sid:200006091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefocaltherapyfoundation.org",nocase; classtype:attempted-recon; sid:200006092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theinteractionlabs.com",nocase; classtype:attempted-recon; sid:200006093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thekingsandqueens.in",nocase; classtype:attempted-recon; sid:200006094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themarketingdream.com",nocase; classtype:attempted-recon; sid:200006095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themkdiaries.com",nocase; classtype:attempted-recon; sid:200006096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thenine9.com",nocase; classtype:attempted-recon; sid:200006097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thenoticesave.ingamazoncardstart.top",nocase; classtype:attempted-recon; sid:200006098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thepaperdesign.com",nocase; classtype:attempted-recon; sid:200006099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thepinnacle.ie",nocase; classtype:attempted-recon; sid:200006100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therockacc.org",nocase; classtype:attempted-recon; sid:200006101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theroesers.com",nocase; classtype:attempted-recon; sid:200006102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therooftop.nyc",nocase; classtype:attempted-recon; sid:200006103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thescrapescape.com",nocase; classtype:attempted-recon; sid:200006104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thesozone.net",nocase; classtype:attempted-recon; sid:200006105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thespiritualtransformation.com",nocase; classtype:attempted-recon; sid:200006106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thetoppersindia.com",nocase; classtype:attempted-recon; sid:200006107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theultimatelistener.com",nocase; classtype:attempted-recon; sid:200006108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theumashow.com",nocase; classtype:attempted-recon; sid:200006109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thissubdomainshouldnotexist.electrumproject.xyz",nocase; classtype:attempted-recon; sid:200006110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thomasdentalcentre.com",nocase; classtype:attempted-recon; sid:200006111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"three-retail-live.devicetradein.co.uk",nocase; classtype:attempted-recon; sid:200006112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiaozhuanyu.ga",nocase; classtype:attempted-recon; sid:200006113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiaozhxuakj.ga",nocase; classtype:attempted-recon; sid:200006114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiaozhxuakj.gq",nocase; classtype:attempted-recon; sid:200006115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tighi.creatorlink.net",nocase; classtype:attempted-recon; sid:200006116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tikiimage.devotedcreations.com",nocase; classtype:attempted-recon; sid:200006117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"timecode.com.sa",nocase; classtype:attempted-recon; sid:200006118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"timeenigma.com#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinavegaphotography.com",nocase; classtype:attempted-recon; sid:200006120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinify.ir",nocase; classtype:attempted-recon; sid:200006121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tirozhjewelry.com",nocase; classtype:attempted-recon; sid:200006122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"titelinedrillingintl.yolasite.com",nocase; classtype:attempted-recon; sid:200006123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tixjpeav.com",nocase; classtype:attempted-recon; sid:200006124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tkx29.codesandbox.io",nocase; classtype:attempted-recon; sid:200006125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlatx.com",nocase; classtype:attempted-recon; sid:200006126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tm55trk.com",nocase; classtype:attempted-recon; sid:200006127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tmphysio.de",nocase; classtype:attempted-recon; sid:200006128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tng84.hyperphp.com",nocase; classtype:attempted-recon; sid:200006129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to-ken.biz",nocase; classtype:attempted-recon; sid:200006130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to.to",nocase; classtype:attempted-recon; sid:200006131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toancaupumps.com",nocase; classtype:attempted-recon; sid:200006132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toanhoc247.edu.vn",nocase; classtype:attempted-recon; sid:200006133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toddler-town.com",nocase; classtype:attempted-recon; sid:200006134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"todosmecaenbien.cl",nocase; classtype:attempted-recon; sid:200006135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"todosprodutos.com.br",nocase; classtype:attempted-recon; sid:200006136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokartsmedia.com",nocase; classtype:attempted-recon; sid:200006137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokenencrypt.com",nocase; classtype:attempted-recon; sid:200006138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokullarmobilya.com",nocase; classtype:attempted-recon; sid:200006139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomobriencarcompanies.com",nocase; classtype:attempted-recon; sid:200006140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomori22.my.id",nocase; classtype:attempted-recon; sid:200006141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tooljerejin.airsite.co",nocase; classtype:attempted-recon; sid:200006142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toothy.ca",nocase; classtype:attempted-recon; sid:200006143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top10songsnews.com",nocase; classtype:attempted-recon; sid:200006144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top30colombiapp.com",nocase; classtype:attempted-recon; sid:200006145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topclassicrockvids.com",nocase; classtype:attempted-recon; sid:200006146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topnews-eu.com",nocase; classtype:attempted-recon; sid:200006147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toponlinewebmail.weebly.com",nocase; classtype:attempted-recon; sid:200006148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toprolls.com.tr",nocase; classtype:attempted-recon; sid:200006149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topskills.ru",nocase; classtype:attempted-recon; sid:200006150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"torccolborrachas.blogspot.com",nocase; classtype:attempted-recon; sid:200006151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"torrinwine.com",nocase; classtype:attempted-recon; sid:200006152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tow1.photoclub-ebroicien.fr",nocase; classtype:attempted-recon; sid:200006153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tpq74.codesandbox.io",nocase; classtype:attempted-recon; sid:200006154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tracking.gobelets.info",nocase; classtype:attempted-recon; sid:200006155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trackshipe73dhy.allgolfeverything.com",nocase; classtype:attempted-recon; sid:200006156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trade-identify.com",nocase; classtype:attempted-recon; sid:200006157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trade-verify.com",nocase; classtype:attempted-recon; sid:200006158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"traderstruth.biz",nocase; classtype:attempted-recon; sid:200006159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tradeswarehouse.com",nocase; classtype:attempted-recon; sid:200006160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trafitoloquera.byethost33.com",nocase; classtype:attempted-recon; sid:200006161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trainingprofits.com",nocase; classtype:attempted-recon; sid:200006162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tramitesmicit-lineapersonalbccr.com",nocase; classtype:attempted-recon; sid:200006163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trams.mot.go.th",nocase; classtype:attempted-recon; sid:200006164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferenciasinternacionaleswise.com",nocase; classtype:attempted-recon; sid:200006165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferpricing.firs.gov.ng",nocase; classtype:attempted-recon; sid:200006166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.googletagcontent.com",nocase; classtype:attempted-recon; sid:200006167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transmancomplain.com",nocase; classtype:attempted-recon; sid:200006168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transmancomplain.net",nocase; classtype:attempted-recon; sid:200006169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trastme.com",nocase; classtype:attempted-recon; sid:200006170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travelingislifetours.com",nocase; classtype:attempted-recon; sid:200006171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travelografo.com",nocase; classtype:attempted-recon; sid:200006172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travelzeed.com",nocase; classtype:attempted-recon; sid:200006173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travosh.com",nocase; classtype:attempted-recon; sid:200006174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trelock.com",nocase; classtype:attempted-recon; sid:200006175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"treqin.com",nocase; classtype:attempted-recon; sid:200006176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonindia.com",nocase; classtype:attempted-recon; sid:200006177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tricklyworking.xyz",nocase; classtype:attempted-recon; sid:200006178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triggermarketing.biz",nocase; classtype:attempted-recon; sid:200006179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trilles157.typeform.com",nocase; classtype:attempted-recon; sid:200006180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tripane05.info",nocase; classtype:attempted-recon; sid:200006181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trk.fjenterprisemarketinginc.com",nocase; classtype:attempted-recon; sid:200006182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"troplamblem.com",nocase; classtype:attempted-recon; sid:200006183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"truckcalling.com",nocase; classtype:attempted-recon; sid:200006184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trucktrader.com.my",nocase; classtype:attempted-recon; sid:200006185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"true-fish.ru",nocase; classtype:attempted-recon; sid:200006186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trustndrive.articon.co.in",nocase; classtype:attempted-recon; sid:200006187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tryitfreede.weebly.com",nocase; classtype:attempted-recon; sid:200006188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ts.hust.edu.vn",nocase; classtype:attempted-recon; sid:200006189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsallagti.ru",nocase; classtype:attempted-recon; sid:200006190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsecure-paxful.com",nocase; classtype:attempted-recon; sid:200006191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsuzuki.co.id",nocase; classtype:attempted-recon; sid:200006192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ttsqyr.classsizecounts.com",nocase; classtype:attempted-recon; sid:200006193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tudosobretudo.blog.br",nocase; classtype:attempted-recon; sid:200006194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tupa90192.byethost7.com",nocase; classtype:attempted-recon; sid:200006195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turawa-ostoja.pl",nocase; classtype:attempted-recon; sid:200006196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turboflightpros.com",nocase; classtype:attempted-recon; sid:200006197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turnermob.com",nocase; classtype:attempted-recon; sid:200006198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turnoonline.bancociuodad.repl.co",nocase; classtype:attempted-recon; sid:200006199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tv4k-magazineluiza.com",nocase; classtype:attempted-recon; sid:200006200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tvbatistasiao.cng.br",nocase; classtype:attempted-recon; sid:200006201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twitteranalytis.com",nocase; classtype:attempted-recon; sid:200006202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twowheelcool.com",nocase; classtype:attempted-recon; sid:200006203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tx.vc",nocase; classtype:attempted-recon; sid:200006204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"txwnmdsbqghviqxpglgzjrgbzv-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200006205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tycoongew.com",nocase; classtype:attempted-recon; sid:200006206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"typesmartlyocr.com",nocase; classtype:attempted-recon; sid:200006207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyrecentre.ru",nocase; classtype:attempted-recon; sid:200006208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyuiutuuooiuuyiyt.square.site",nocase; classtype:attempted-recon; sid:200006209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyzwox.webwave.dev",nocase; classtype:attempted-recon; sid:200006210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tzcucuzjukmjpdqpthhyivrvmehupq.66ghz.com",nocase; classtype:attempted-recon; sid:200006211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tzsxmly.cn",nocase; classtype:attempted-recon; sid:200006212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u08qv44zu5h.typeform.com",nocase; classtype:attempted-recon; sid:200006213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u1309597jq0.ha004.t.justns.ru",nocase; classtype:attempted-recon; sid:200006214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u1409685.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200006215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u18741649.ct.sendgrid.net",nocase; classtype:attempted-recon; sid:200006216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u443456b3l.ha004.t.justns.ru",nocase; classtype:attempted-recon; sid:200006217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u4ifw.csb.app",nocase; classtype:attempted-recon; sid:200006218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u4ti57.cn",nocase; classtype:attempted-recon; sid:200006219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u8tny.skipdns.link",nocase; classtype:attempted-recon; sid:200006220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ubee.co.kr",nocase; classtype:attempted-recon; sid:200006221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ucbonline.com",nocase; classtype:attempted-recon; sid:200006222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uceuk1141124991.rf.gd",nocase; classtype:attempted-recon; sid:200006223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ucheksacountpg.rf.gd",nocase; classtype:attempted-recon; sid:200006224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uckesdpg.rf.gd",nocase; classtype:attempted-recon; sid:200006225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"udrescounfg.rf.gd",nocase; classtype:attempted-recon; sid:200006226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uglcsonfonia.org",nocase; classtype:attempted-recon; sid:200006227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uguett.hyperphp.com",nocase; classtype:attempted-recon; sid:200006228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uimn.xyz",nocase; classtype:attempted-recon; sid:200006229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com",nocase; classtype:attempted-recon; sid:200006230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uiz-mouioesasnc.serveblog.net",nocase; classtype:attempted-recon; sid:200006231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ujs612.activehosted.com",nocase; classtype:attempted-recon; sid:200006232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk-dispatch.com",nocase; classtype:attempted-recon; sid:200006233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk-security9238.com",nocase; classtype:attempted-recon; sid:200006234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk0qx.codesandbox.io",nocase; classtype:attempted-recon; sid:200006235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukabgroup.com",nocase; classtype:attempted-recon; sid:200006236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukcare.in",nocase; classtype:attempted-recon; sid:200006237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukmedapp.com",nocase; classtype:attempted-recon; sid:200006238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukpostal-delivery.com",nocase; classtype:attempted-recon; sid:200006239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukpostal-fee.com",nocase; classtype:attempted-recon; sid:200006240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukresidential-servicesupport.com",nocase; classtype:attempted-recon; sid:200006241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukulelebuys.com",nocase; classtype:attempted-recon; sid:200006242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ulnvbwq.cn",nocase; classtype:attempted-recon; sid:200006243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimatecards.bermudastudios.nl",nocase; classtype:attempted-recon; sid:200006244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimatemotors.co.ke",nocase; classtype:attempted-recon; sid:200006245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimateseguri9.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200006246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umbrellaclubla.com",nocase; classtype:attempted-recon; sid:200006247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umeacademy.com",nocase; classtype:attempted-recon; sid:200006248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ummatamima.buet.ac.bd",nocase; classtype:attempted-recon; sid:200006249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umu.link",nocase; classtype:attempted-recon; sid:200006250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umzap.com",nocase; classtype:attempted-recon; sid:200006251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"un9d1h3qbs9.typeform.com",nocase; classtype:attempted-recon; sid:200006252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unam.myfreesites.net",nocase; classtype:attempted-recon; sid:200006253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-login-attempt872.com",nocase; classtype:attempted-recon; sid:200006254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthoriserecentdevice.com",nocase; classtype:attempted-recon; sid:200006255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unclokacccount.rf.gd",nocase; classtype:attempted-recon; sid:200006256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"undc.edu.pe",nocase; classtype:attempted-recon; sid:200006257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"undreascopg.rf.gd",nocase; classtype:attempted-recon; sid:200006258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unfairworkaustralia.com.au",nocase; classtype:attempted-recon; sid:200006259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uni0nbnkoffphsavign.serveuser.com",nocase; classtype:attempted-recon; sid:200006260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unicwap.com",nocase; classtype:attempted-recon; sid:200006261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unifacema.edu.br",nocase; classtype:attempted-recon; sid:200006262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniget.in",nocase; classtype:attempted-recon; sid:200006263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unimaisfm.com.br",nocase; classtype:attempted-recon; sid:200006264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unionheightsresidental.com",nocase; classtype:attempted-recon; sid:200006265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unisons.store",nocase; classtype:attempted-recon; sid:200006266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unisonsouthayr.org.uk",nocase; classtype:attempted-recon; sid:200006267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-consid.tech",nocase; classtype:attempted-recon; sid:200006268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-die.tech",nocase; classtype:attempted-recon; sid:200006269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-feel.tech",nocase; classtype:attempted-recon; sid:200006270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-right.tech",nocase; classtype:attempted-recon; sid:200006271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-seem.tech",nocase; classtype:attempted-recon; sid:200006272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-seems.tech",nocase; classtype:attempted-recon; sid:200006273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-strong.tech",nocase; classtype:attempted-recon; sid:200006274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.ch",nocase; classtype:attempted-recon; sid:200006275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.deals",nocase; classtype:attempted-recon; sid:200006276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.openwallet.dev",nocase; classtype:attempted-recon; sid:200006277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.pages.dev",nocase; classtype:attempted-recon; sid:200006278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.seal.finance",nocase; classtype:attempted-recon; sid:200006279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.token.im",nocase; classtype:attempted-recon; sid:200006280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.trading",nocase; classtype:attempted-recon; sid:200006281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.vn",nocase; classtype:attempted-recon; sid:200006282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswapeth.net",nocase; classtype:attempted-recon; sid:200006283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswapfinancing.info",nocase; classtype:attempted-recon; sid:200006284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswapn.org",nocase; classtype:attempted-recon; sid:200006285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitib.com",nocase; classtype:attempted-recon; sid:200006286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; classtype:attempted-recon; sid:200006287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"universidadsanjuan.ac",nocase; classtype:attempted-recon; sid:200006288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"univswap.me",nocase; classtype:attempted-recon; sid:200006289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unjmnerepqzeaztbkdrqdiwmukjkzw.66ghz.com",nocase; classtype:attempted-recon; sid:200006290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlock-suspension.com",nocase; classtype:attempted-recon; sid:200006291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregister-device-seclloyd.com",nocase; classtype:attempted-recon; sid:200006292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregpayee-lb.com",nocase; classtype:attempted-recon; sid:200006293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unterchesd.rf.gd",nocase; classtype:attempted-recon; sid:200006294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"untercoinfrm.rf.gd",nocase; classtype:attempted-recon; sid:200006295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"untredaapchejk.rf.gd",nocase; classtype:attempted-recon; sid:200006296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uols024djpd.byethost9.com",nocase; classtype:attempted-recon; sid:200006297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-cyxhjas23qjhk.de",nocase; classtype:attempted-recon; sid:200006298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-officeinfo.finecashflow.com",nocase; classtype:attempted-recon; sid:200006299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-portal-sparkasse.com",nocase; classtype:attempted-recon; sid:200006300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-spk-zentrale.com",nocase; classtype:attempted-recon; sid:200006301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update365online-secure.com",nocase; classtype:attempted-recon; sid:200006302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updateinfo-billingo2.com",nocase; classtype:attempted-recon; sid:200006303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatemysantan.com",nocase; classtype:attempted-recon; sid:200006304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updateseason.com",nocase; classtype:attempted-recon; sid:200006305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatetosave.ingamazoncardstart.cyou",nocase; classtype:attempted-recon; sid:200006306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatetosaveto.ingamazoncardstart.cyou",nocase; classtype:attempted-recon; sid:200006307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatevoda-billing.com",nocase; classtype:attempted-recon; sid:200006308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatewithoutdelay.toonlineamazonpresence.shop",nocase; classtype:attempted-recon; sid:200006309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updted-access.demopage.co",nocase; classtype:attempted-recon; sid:200006310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgrade-25gb-email.alfaoneinfotech.net",nocase; classtype:attempted-recon; sid:200006311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgrade-25gb-email.thecornerstudio.com.au",nocase; classtype:attempted-recon; sid:200006312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgradesp-arkassen-endkunden.com",nocase; classtype:attempted-recon; sid:200006313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uploads.codesandbox.io",nocase; classtype:attempted-recon; sid:200006314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbancultureproject.org",nocase; classtype:attempted-recon; sid:200006315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbannetw45ork.ru",nocase; classtype:attempted-recon; sid:200006316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbenorte.com",nocase; classtype:attempted-recon; sid:200006317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urgent-halifaxlogin.com",nocase; classtype:attempted-recon; sid:200006318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlchill.com",nocase; classtype:attempted-recon; sid:200006319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlday.cc",nocase; classtype:attempted-recon; sid:200006320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlng.com",nocase; classtype:attempted-recon; sid:200006321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlth.me",nocase; classtype:attempted-recon; sid:200006322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urusartuyu.byethost7.com",nocase; classtype:attempted-recon; sid:200006323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us-paypal.dns04.com",nocase; classtype:attempted-recon; sid:200006324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usaerrtyhui.blogspot.com",nocase; classtype:attempted-recon; sid:200006325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usbexpert.it",nocase; classtype:attempted-recon; sid:200006326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"useful-modern-porch.glitch.me",nocase; classtype:attempted-recon; sid:200006327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"user-6f90h.web.app",nocase; classtype:attempted-recon; sid:200006328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"user-restore.com",nocase; classtype:attempted-recon; sid:200006329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"userreport01.byethost16.com",nocase; classtype:attempted-recon; sid:200006330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"users.tpg.com.au",nocase; classtype:attempted-recon; sid:200006331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usfn.net",nocase; classtype:attempted-recon; sid:200006332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"utilizzamps.com",nocase; classtype:attempted-recon; sid:200006333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"utopiacs.com.au",nocase; classtype:attempted-recon; sid:200006334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuid-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200006335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uwteruggave2020.xyz",nocase; classtype:attempted-recon; sid:200006336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uy658.weebly.com",nocase; classtype:attempted-recon; sid:200006337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uyipert.tk",nocase; classtype:attempted-recon; sid:200006338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uyipertx.tk",nocase; classtype:attempted-recon; sid:200006339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uytdsa.ga",nocase; classtype:attempted-recon; sid:200006340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uytg.hyperphp.com",nocase; classtype:attempted-recon; sid:200006341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uytity.tk",nocase; classtype:attempted-recon; sid:200006342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uzaqztk7ovr.typeform.com",nocase; classtype:attempted-recon; sid:200006343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v-sys.mhlw.go.jp",nocase; classtype:attempted-recon; sid:200006344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v1nted.xyz",nocase; classtype:attempted-recon; sid:200006345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v7cf.gratishosting.cl",nocase; classtype:attempted-recon; sid:200006346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v7zrh.codesandbox.io",nocase; classtype:attempted-recon; sid:200006347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vagheshvareeengworks.com",nocase; classtype:attempted-recon; sid:200006348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaikis.eu",nocase; classtype:attempted-recon; sid:200006349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaimtec.cl",nocase; classtype:attempted-recon; sid:200006350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifbildirimonay.xyz",nocase; classtype:attempted-recon; sid:200006351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifcilarhepberaber.com",nocase; classtype:attempted-recon; sid:200006352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifegitimkurumlari.ml",nocase; classtype:attempted-recon; sid:200006353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifiadem.b-cdn.net",nocase; classtype:attempted-recon; sid:200006354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifkatilimbireyselsubegiris.cf",nocase; classtype:attempted-recon; sid:200006355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valenciaoptometry.com",nocase; classtype:attempted-recon; sid:200006356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valenteplay.com.br",nocase; classtype:attempted-recon; sid:200006357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validacionpichincha.odoo.com",nocase; classtype:attempted-recon; sid:200006358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validate-onlinesecurity.com",nocase; classtype:attempted-recon; sid:200006359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validateswallets.com",nocase; classtype:attempted-recon; sid:200006360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validation-newpayee.com",nocase; classtype:attempted-recon; sid:200006361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validationsystem.creatorlink.net",nocase; classtype:attempted-recon; sid:200006362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validator-fzkiy.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200006363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validazonaseguraviabcpbeta-pe.com",nocase; classtype:attempted-recon; sid:200006364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validtion-accts131sd.ml",nocase; classtype:attempted-recon; sid:200006365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vallejomendoza.com",nocase; classtype:attempted-recon; sid:200006366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vanvleetfamilyfarm.com",nocase; classtype:attempted-recon; sid:200006367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaoas.cc",nocase; classtype:attempted-recon; sid:200006368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vc42ewypf1.li1ba2t1mnkddlqbeplxcoswecan.com",nocase; classtype:attempted-recon; sid:200006369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vcpjo.weblium.site",nocase; classtype:attempted-recon; sid:200006370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vdwqcyty9789087.square.site",nocase; classtype:attempted-recon; sid:200006371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vecsax.viasvo.com",nocase; classtype:attempted-recon; sid:200006372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vecsax.vivcxve.com",nocase; classtype:attempted-recon; sid:200006373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vegas-x.net",nocase; classtype:attempted-recon; sid:200006374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vehicam.com",nocase; classtype:attempted-recon; sid:200006375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvish.com",nocase; classtype:attempted-recon; sid:200006376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vendorcmdecport.vzpla.net",nocase; classtype:attempted-recon; sid:200006377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verfiz.me",nocase; classtype:attempted-recon; sid:200006378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifica.ch",nocase; classtype:attempted-recon; sid:200006379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificar-7482376.vzpla.net",nocase; classtype:attempted-recon; sid:200006380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verification-orange0.yolasite.com",nocase; classtype:attempted-recon; sid:200006381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verification.page.home.support.app-netflix.com.mavhcodigital.com",nocase; classtype:attempted-recon; sid:200006382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificationmessage.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200006383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verified-wellsfservice.otzo.com",nocase; classtype:attempted-recon; sid:200006384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-anda0011.weeblysite.com",nocase; classtype:attempted-recon; sid:200006385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-facebook0022.weeblysite.com",nocase; classtype:attempted-recon; sid:200006386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifiyedbluetickfeedback.ml",nocase; classtype:attempted-recon; sid:200006387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.chase.billing.info.igualdad.cl",nocase; classtype:attempted-recon; sid:200006388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.paypal-help-service.com",nocase; classtype:attempted-recon; sid:200006389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.session-id.com",nocase; classtype:attempted-recon; sid:200006390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifyidentity-now.vercentretv.icu",nocase; classtype:attempted-recon; sid:200006391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifymytransfer.com",nocase; classtype:attempted-recon; sid:200006392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verikasi-account2021.weebly.com",nocase; classtype:attempted-recon; sid:200006393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"veryleboncoin.ru",nocase; classtype:attempted-recon; sid:200006394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verzeichnisse.creatorlink.net",nocase; classtype:attempted-recon; sid:200006395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesic.vciesn.top",nocase; classtype:attempted-recon; sid:200006396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesic.vivcoee.com",nocase; classtype:attempted-recon; sid:200006397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesic.vivcoes.com",nocase; classtype:attempted-recon; sid:200006398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesic.vivcsi.top",nocase; classtype:attempted-recon; sid:200006399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesic.vviesni.top",nocase; classtype:attempted-recon; sid:200006400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vesicasswiskaban.com",nocase; classtype:attempted-recon; sid:200006401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahis211.blogspot.com",nocase; classtype:attempted-recon; sid:200006402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisbet.blogspot.com",nocase; classtype:attempted-recon; sid:200006403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgirissite.blogspot.com",nocase; classtype:attempted-recon; sid:200006404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgunceladres.blogspot.com",nocase; classtype:attempted-recon; sid:200006405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisimgir.blogspot.com",nocase; classtype:attempted-recon; sid:200006406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss.blogspot.com",nocase; classtype:attempted-recon; sid:200006407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200006408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissgir.blogspot.com",nocase; classtype:attempted-recon; sid:200006409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200006410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahsgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200006411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevoobahis.blogspot.com",nocase; classtype:attempted-recon; sid:200006412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vexegpo.ga",nocase; classtype:attempted-recon; sid:200006413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vfr1.22web.org",nocase; classtype:attempted-recon; sid:200006414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vfstech.co.uk",nocase; classtype:attempted-recon; sid:200006415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vgx2plur.cn",nocase; classtype:attempted-recon; sid:200006416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vhs.link",nocase; classtype:attempted-recon; sid:200006417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp-ganadiario.online",nocase; classtype:attempted-recon; sid:200006418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp-ganaperu.online",nocase; classtype:attempted-recon; sid:200006419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp-participadiario.live",nocase; classtype:attempted-recon; sid:200006420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp.ingresoseguro.online",nocase; classtype:attempted-recon; sid:200006421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcpv.com",nocase; classtype:attempted-recon; sid:200006422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vices.eu",nocase; classtype:attempted-recon; sid:200006423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vicse.vivcoee.com",nocase; classtype:attempted-recon; sid:200006424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vicse.vivcoes.com",nocase; classtype:attempted-recon; sid:200006425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"victorarath99.github.io",nocase; classtype:attempted-recon; sid:200006426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vidco.dotcompal.co",nocase; classtype:attempted-recon; sid:200006427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"videobigo.com",nocase; classtype:attempted-recon; sid:200006428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"videowatchviral.blogspot.com",nocase; classtype:attempted-recon; sid:200006429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vietschi.de",nocase; classtype:attempted-recon; sid:200006430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200006431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vievsc.viasvo.com",nocase; classtype:attempted-recon; sid:200006432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vievsc.vivcxve.com",nocase; classtype:attempted-recon; sid:200006433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viicvsa.viasvo.com",nocase; classtype:attempted-recon; sid:200006434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viicvsa.vivcxve.com",nocase; classtype:attempted-recon; sid:200006435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vija02.cn",nocase; classtype:attempted-recon; sid:200006436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vikinger-danceband.de",nocase; classtype:attempted-recon; sid:200006437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vikingwear.com",nocase; classtype:attempted-recon; sid:200006438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vilanovacenter.com",nocase; classtype:attempted-recon; sid:200006439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinahay.com",nocase; classtype:attempted-recon; sid:200006440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinbpcfatfnkjftetwwkucfqsi-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200006441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinivet.mk",nocase; classtype:attempted-recon; sid:200006442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinted-jeg.id-info8767.me",nocase; classtype:attempted-recon; sid:200006443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinted-pl.8469313.space",nocase; classtype:attempted-recon; sid:200006444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinted-vor.id-info0701.me",nocase; classtype:attempted-recon; sid:200006445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinylbanner.net.au",nocase; classtype:attempted-recon; sid:200006446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vipbillspaymentcenternegosyo.com",nocase; classtype:attempted-recon; sid:200006447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vipfbtools.com",nocase; classtype:attempted-recon; sid:200006448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virall41detikkk.duckdns.org",nocase; classtype:attempted-recon; sid:200006449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vire.idfleboncoin.com",nocase; classtype:attempted-recon; sid:200006450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virii-my-mtb.com",nocase; classtype:attempted-recon; sid:200006451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virtual1dattss.com",nocase; classtype:attempted-recon; sid:200006452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vis-stort.github.io",nocase; classtype:attempted-recon; sid:200006453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visadpsgiftcard.com",nocase; classtype:attempted-recon; sid:200006454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visawingsoverseas.com",nocase; classtype:attempted-recon; sid:200006455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visce.vciesn.top",nocase; classtype:attempted-recon; sid:200006456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visce.viesni.top",nocase; classtype:attempted-recon; sid:200006457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visce.vivcsi.top",nocase; classtype:attempted-recon; sid:200006458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visce.vviesni.top",nocase; classtype:attempted-recon; sid:200006459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visecaonlinz2021.up.seesaa.net",nocase; classtype:attempted-recon; sid:200006460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visione.co.id",nocase; classtype:attempted-recon; sid:200006461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visioninfo.be",nocase; classtype:attempted-recon; sid:200006462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visit-spk-update.com",nocase; classtype:attempted-recon; sid:200006463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visualspider.top",nocase; classtype:attempted-recon; sid:200006464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visve.vivcoee.com",nocase; classtype:attempted-recon; sid:200006465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visve.vivcoes.com",nocase; classtype:attempted-recon; sid:200006466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vitallinkacademy.com.ng",nocase; classtype:attempted-recon; sid:200006467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivaanadventure.com",nocase; classtype:attempted-recon; sid:200006468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivalagaleria.com",nocase; classtype:attempted-recon; sid:200006469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivocrm.ru",nocase; classtype:attempted-recon; sid:200006470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivvs.viasvo.com",nocase; classtype:attempted-recon; sid:200006471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivvs.vivcxve.com",nocase; classtype:attempted-recon; sid:200006472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-coolsgirl.ru",nocase; classtype:attempted-recon; sid:200006473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-dreamsgirls.ru",nocase; classtype:attempted-recon; sid:200006474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-kittygirl.ru",nocase; classtype:attempted-recon; sid:200006475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-tops-babys.ru",nocase; classtype:attempted-recon; sid:200006476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-tops-babys.site",nocase; classtype:attempted-recon; sid:200006477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vknewsonline.ru",nocase; classtype:attempted-recon; sid:200006478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vlabecepevalidarperu.com",nocase; classtype:attempted-recon; sid:200006479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vmospi111.freecluster.eu",nocase; classtype:attempted-recon; sid:200006480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vnsei.vivcoes.com",nocase; classtype:attempted-recon; sid:200006481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocal-esp.yolasite.com",nocase; classtype:attempted-recon; sid:200006482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocalcoachingbysloane.com",nocase; classtype:attempted-recon; sid:200006483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voda-direct-billing.wtwister.com",nocase; classtype:attempted-recon; sid:200006484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafone.bill1820.com",nocase; classtype:attempted-recon; sid:200006485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; classtype:attempted-recon; sid:200006486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodaupdatepayment.com",nocase; classtype:attempted-recon; sid:200006487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodpool.cf",nocase; classtype:attempted-recon; sid:200006488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voed.ru",nocase; classtype:attempted-recon; sid:200006489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voicebymargo.com",nocase; classtype:attempted-recon; sid:200006490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"volvocarskc.us1.list-manage.com",nocase; classtype:attempted-recon; sid:200006491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voteschiller.com",nocase; classtype:attempted-recon; sid:200006492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votre-espace-97dd5c.ingress-daribow.easywp.com",nocase; classtype:attempted-recon; sid:200006493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votre-messagerie-vocaux0.yolasite.com",nocase; classtype:attempted-recon; sid:200006494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votre.service.client.forfait.orange.mobile.travelforever.co.uk",nocase; classtype:attempted-recon; sid:200006495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpapara.com",nocase; classtype:attempted-recon; sid:200006496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vps41123.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200006497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vps73745.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200006498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpvoepaevss.pw",nocase; classtype:attempted-recon; sid:200006499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqwd.soboja1994.workers.dev",nocase; classtype:attempted-recon; sid:200006500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqws.zotratorte.workers.dev",nocase; classtype:attempted-recon; sid:200006501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqwv.hovoyef278.workers.dev",nocase; classtype:attempted-recon; sid:200006502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vrbe.in",nocase; classtype:attempted-recon; sid:200006503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vseic.vivcoee.com",nocase; classtype:attempted-recon; sid:200006504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vseic.vivcoes.com",nocase; classtype:attempted-recon; sid:200006505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vsevi.viasvo.com",nocase; classtype:attempted-recon; sid:200006506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vsevi.vivcxve.com",nocase; classtype:attempted-recon; sid:200006507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vt3pa0.webwave.dev",nocase; classtype:attempted-recon; sid:200006508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtekllc.com",nocase; classtype:attempted-recon; sid:200006509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtxmail2018.myfreesites.net",nocase; classtype:attempted-recon; sid:200006510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vuci.com",nocase; classtype:attempted-recon; sid:200006511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vugik.mecil33784.workers.dev",nocase; classtype:attempted-recon; sid:200006512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vugik.vomaliv389.workers.dev",nocase; classtype:attempted-recon; sid:200006513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vuisjaolenskdvpeeass.icu",nocase; classtype:attempted-recon; sid:200006514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvideeooneww.duckdns.org",nocase; classtype:attempted-recon; sid:200006515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvnoreply.00svmvoice.xyz",nocase; classtype:attempted-recon; sid:200006516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvvvw-metam.top",nocase; classtype:attempted-recon; sid:200006517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvvvw-metamas.top",nocase; classtype:attempted-recon; sid:200006518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvwwmetams.top",nocase; classtype:attempted-recon; sid:200006519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvwwmeta.top",nocase; classtype:attempted-recon; sid:200006520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vwbank.inforia.net",nocase; classtype:attempted-recon; sid:200006521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vwvvbcpi-zonasegura.com",nocase; classtype:attempted-recon; sid:200006522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vxdse.myfreesites.net",nocase; classtype:attempted-recon; sid:200006523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vxmu688484.byethost7.com",nocase; classtype:attempted-recon; sid:200006524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vyixwx.webwave.dev",nocase; classtype:attempted-recon; sid:200006525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vypvracha.ru",nocase; classtype:attempted-recon; sid:200006526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vzrew.creatorlink.net",nocase; classtype:attempted-recon; sid:200006527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w0ei0t4n1x.achiekaugmemitmydaudiologi.com",nocase; classtype:attempted-recon; sid:200006528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w2.deraya.org",nocase; classtype:attempted-recon; sid:200006529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w352883-www.fnweb.no",nocase; classtype:attempted-recon; sid:200006530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w352885-www.fnweb.no",nocase; classtype:attempted-recon; sid:200006531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w3max.com",nocase; classtype:attempted-recon; sid:200006532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w5aproject.s3.us-east.cloud-object-storage.appdomain.cloud",nocase; classtype:attempted-recon; sid:200006533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w5czf.csb.app",nocase; classtype:attempted-recon; sid:200006534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w6634s.webwave.dev",nocase; classtype:attempted-recon; sid:200006535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wagrubb-new02983.duckdns.org",nocase; classtype:attempted-recon; sid:200006536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wagrupnotnot8.duckdns.org",nocase; classtype:attempted-recon; sid:200006537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wahed-koudsi2001.github.io",nocase; classtype:attempted-recon; sid:200006538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waisterase.com",nocase; classtype:attempted-recon; sid:200006539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walldesign.com.tr",nocase; classtype:attempted-recon; sid:200006540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallectconnect.co",nocase; classtype:attempted-recon; sid:200006541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-mymanero.com",nocase; classtype:attempted-recon; sid:200006542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnecttalk.com",nocase; classtype:attempted-recon; sid:200006543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnetsynczserver.com",nocase; classtype:attempted-recon; sid:200006544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletmetomack.com",nocase; classtype:attempted-recon; sid:200006545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsconnectaid.com",nocase; classtype:attempted-recon; sid:200006546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsdappconnection.com",nocase; classtype:attempted-recon; sid:200006547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletslive-synchronization.com",nocase; classtype:attempted-recon; sid:200006548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsynchronisation.net",nocase; classtype:attempted-recon; sid:200006549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsynchronise.com",nocase; classtype:attempted-recon; sid:200006550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletvalidators.com",nocase; classtype:attempted-recon; sid:200006551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletxsconn.com",nocase; classtype:attempted-recon; sid:200006552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallletsconnectts.net",nocase; classtype:attempted-recon; sid:200006553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wana78420.myfreesites.net",nocase; classtype:attempted-recon; sid:200006554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wanchengtextile.com",nocase; classtype:attempted-recon; sid:200006555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wandering-scene-82d4.braveheartbull.workers.dev",nocase; classtype:attempted-recon; sid:200006556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wantransparancypagesadministratorhelp.co.vu",nocase; classtype:attempted-recon; sid:200006557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitflyer.live",nocase; classtype:attempted-recon; sid:200006558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitflyer.plus",nocase; classtype:attempted-recon; sid:200006559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitflyer.venus.kim",nocase; classtype:attempted-recon; sid:200006560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wapiae.com.ar",nocase; classtype:attempted-recon; sid:200006561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warefert.000webhostapp.com",nocase; classtype:attempted-recon; sid:200006562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warningshadows.org",nocase; classtype:attempted-recon; sid:200006563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warsa.bandungkab.go.id",nocase; classtype:attempted-recon; sid:200006564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wasahyd.com.pk",nocase; classtype:attempted-recon; sid:200006565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watan99.com",nocase; classtype:attempted-recon; sid:200006566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watchlove.michaelkorsoutlet2u.cn",nocase; classtype:attempted-recon; sid:200006567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watermelonineasterhay.com",nocase; classtype:attempted-recon; sid:200006568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waycacoke.com",nocase; classtype:attempted-recon; sid:200006569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wazefornay.byethost16.com",nocase; classtype:attempted-recon; sid:200006570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"we-exodus-wallet.yahoosites.com",nocase; classtype:attempted-recon; sid:200006571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weaveessentialgoodness.cloud",nocase; classtype:attempted-recon; sid:200006572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-armas.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200006573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-b4119.web.app",nocase; classtype:attempted-recon; sid:200006574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-e1f6d.web.app",nocase; classtype:attempted-recon; sid:200006575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-exobuss.com",nocase; classtype:attempted-recon; sid:200006576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-exoduss.com",nocase; classtype:attempted-recon; sid:200006577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-portal-login-mailservice.com",nocase; classtype:attempted-recon; sid:200006578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-rechungbetrag-domain.de",nocase; classtype:attempted-recon; sid:200006579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-santander.byethost31.com",nocase; classtype:attempted-recon; sid:200006580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-zona1segurabetaviabcp.com",nocase; classtype:attempted-recon; sid:200006581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.bredbanque.trans.sylog.co",nocase; classtype:attempted-recon; sid:200006582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.onix.com",nocase; classtype:attempted-recon; sid:200006583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200006584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web1577.webbox444.server-home.org",nocase; classtype:attempted-recon; sid:200006585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web6885.web07.bero-webspace.de",nocase; classtype:attempted-recon; sid:200006586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web6901.web07.bero-webspace.de",nocase; classtype:attempted-recon; sid:200006587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webagricoapp.byethost5.com",nocase; classtype:attempted-recon; sid:200006588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbacpichi.byethost14.com",nocase; classtype:attempted-recon; sid:200006589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbbb.yolasite.com",nocase; classtype:attempted-recon; sid:200006590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webcentrinim.wapka.website",nocase; classtype:attempted-recon; sid:200006591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdatamltrainingdiag842.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200006592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdisk.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200006593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webexert.com",nocase; classtype:attempted-recon; sid:200006594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webfiddle.net",nocase; classtype:attempted-recon; sid:200006595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webgaliciatxt.ihostfull.com",nocase; classtype:attempted-recon; sid:200006596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webhostingbingo.com",nocase; classtype:attempted-recon; sid:200006597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webintersol.com",nocase; classtype:attempted-recon; sid:200006598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webip.yolasite.com",nocase; classtype:attempted-recon; sid:200006599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webm1al.fromewill.cf",nocase; classtype:attempted-recon; sid:200006600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-109054b.square.site",nocase; classtype:attempted-recon; sid:200006601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-2aaa0.web.app",nocase; classtype:attempted-recon; sid:200006602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-internet.square.site",nocase; classtype:attempted-recon; sid:200006603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-sso8uyg.web.app",nocase; classtype:attempted-recon; sid:200006604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.authsmsecure.com",nocase; classtype:attempted-recon; sid:200006605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.cgreuroinstalaciones.es",nocase; classtype:attempted-recon; sid:200006606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.gourmer.co.in",nocase; classtype:attempted-recon; sid:200006607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.njea.org",nocase; classtype:attempted-recon; sid:200006608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmailadmin0.myfreesites.net",nocase; classtype:attempted-recon; sid:200006609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmailhosting.brazilsouth.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200006610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weboutlookstorageaccess.activehosted.com",nocase; classtype:attempted-recon; sid:200006611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webportal-unblock-spk.com",nocase; classtype:attempted-recon; sid:200006612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webportalupgradespk.com",nocase; classtype:attempted-recon; sid:200006613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webpromerica.webcindario.com",nocase; classtype:attempted-recon; sid:200006614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webservicocef.com",nocase; classtype:attempted-recon; sid:200006615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"website--355347865560300265249-bank.business.site",nocase; classtype:attempted-recon; sid:200006616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitefun.club",nocase; classtype:attempted-recon; sid:200006617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webstories.eu",nocase; classtype:attempted-recon; sid:200006618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websupport-updatelog-spk.com",nocase; classtype:attempted-recon; sid:200006619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz",nocase; classtype:attempted-recon; sid:200006620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wedbancaonline.byethost13.com",nocase; classtype:attempted-recon; sid:200006621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weelksjgafarogks.azurewebsites.net",nocase; classtype:attempted-recon; sid:200006622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"welcometospringfieldmo.com",nocase; classtype:attempted-recon; sid:200006623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wells-secure1.com",nocase; classtype:attempted-recon; sid:200006624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weplaymatch.net",nocase; classtype:attempted-recon; sid:200006625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"were-want.ru.com",nocase; classtype:attempted-recon; sid:200006626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westernpapersl.com",nocase; classtype:attempted-recon; sid:200006627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westportvillagegallery.com",nocase; classtype:attempted-recon; sid:200006628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weteachbh.com",nocase; classtype:attempted-recon; sid:200006629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wetransfer-view-documentonline.yolasite.com",nocase; classtype:attempted-recon; sid:200006630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wgh3.wghservers.com",nocase; classtype:attempted-recon; sid:200006631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatapp23.duckdns.org",nocase; classtype:attempted-recon; sid:200006632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatapp724.duckdns.org",nocase; classtype:attempted-recon; sid:200006633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatapp96.duckdns.org",nocase; classtype:attempted-recon; sid:200006634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whataspp25.duckdns.org",nocase; classtype:attempted-recon; sid:200006635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whataspp52.duckdns.org",nocase; classtype:attempted-recon; sid:200006636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatepouhill.byethost15.com",nocase; classtype:attempted-recon; sid:200006637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsaapgrub18-joinchat54azx.duckdns.org",nocase; classtype:attempted-recon; sid:200006638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsap-joinchat89bxyz.duckdns.org",nocase; classtype:attempted-recon; sid:200006639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-18.ikwb.com",nocase; classtype:attempted-recon; sid:200006640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-clone-d770f.web.app",nocase; classtype:attempted-recon; sid:200006641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-clone-teamwork.firebaseapp.com",nocase; classtype:attempted-recon; sid:200006642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-group0.duckdns.org",nocase; classtype:attempted-recon; sid:200006643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-grubsx1.zzux.com",nocase; classtype:attempted-recon; sid:200006644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp18girl.4pu.com",nocase; classtype:attempted-recon; sid:200006645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp48.se.ke",nocase; classtype:attempted-recon; sid:200006646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.instanthq.com",nocase; classtype:attempted-recon; sid:200006647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.mrslove.com",nocase; classtype:attempted-recon; sid:200006648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whattsapps.misecure.com",nocase; classtype:attempted-recon; sid:200006649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wheelsofmercy.org",nocase; classtype:attempted-recon; sid:200006650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitelist-network.com",nocase; classtype:attempted-recon; sid:200006651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whyted.com",nocase; classtype:attempted-recon; sid:200006652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"widadkamillah.github.io",nocase; classtype:attempted-recon; sid:200006653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wifi.retinad.com",nocase; classtype:attempted-recon; sid:200006654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wijadisenangbutaarah.co.vu",nocase; classtype:attempted-recon; sid:200006655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildcard.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200006656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildcard.tv1space.az",nocase; classtype:attempted-recon; sid:200006657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildmountainarts.com",nocase; classtype:attempted-recon; sid:200006658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"willtoaccssnowand.cf",nocase; classtype:attempted-recon; sid:200006659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wimracttus.com",nocase; classtype:attempted-recon; sid:200006660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winter-poetry-35e7.andoni-zagouris.workers.dev",nocase; classtype:attempted-recon; sid:200006661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winterfallsranch.com",nocase; classtype:attempted-recon; sid:200006662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winville.biz",nocase; classtype:attempted-recon; sid:200006663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wireconfirmation68c10a25442a3e13.blogspot.com",nocase; classtype:attempted-recon; sid:200006664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wireless4sdg.org.zw",nocase; classtype:attempted-recon; sid:200006665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wires-business-starter.webflow.io",nocase; classtype:attempted-recon; sid:200006666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wirtschaft.baesweiler.de",nocase; classtype:attempted-recon; sid:200006667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wisconsin-dmv-mv3001.com",nocase; classtype:attempted-recon; sid:200006668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wispy-wave-b764.andoni-zagouris.workers.dev",nocase; classtype:attempted-recon; sid:200006669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withyoumall.toonlineamazonpresence.work",nocase; classtype:attempted-recon; sid:200006670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wj2vltyze29.typeform.com",nocase; classtype:attempted-recon; sid:200006671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wkazisan.github.io",nocase; classtype:attempted-recon; sid:200006672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wm2.cefassinaturacadastro.com",nocase; classtype:attempted-recon; sid:200006673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wn82b.skipdns.link",nocase; classtype:attempted-recon; sid:200006674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wolf.danswd.com",nocase; classtype:attempted-recon; sid:200006675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"womancreatorofman.com",nocase; classtype:attempted-recon; sid:200006676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wonderful.gr",nocase; classtype:attempted-recon; sid:200006677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woocommerce-685913-2261873.cloudwaysapps.com",nocase; classtype:attempted-recon; sid:200006678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woomcenter.com",nocase; classtype:attempted-recon; sid:200006679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woquito1-ecttps2.hostkda.com",nocase; classtype:attempted-recon; sid:200006680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wordpress-682005-2245859.cloudwaysapps.com",nocase; classtype:attempted-recon; sid:200006681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workcuencapptss1.hostkda.com",nocase; classtype:attempted-recon; sid:200006682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workforcerelief.com",nocase; classtype:attempted-recon; sid:200006683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workprotocoles-com.webs.com",nocase; classtype:attempted-recon; sid:200006684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"worldwidepbx.com",nocase; classtype:attempted-recon; sid:200006685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp-login.azurewebsites.net",nocase; classtype:attempted-recon; sid:200006686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wpsoar.com",nocase; classtype:attempted-recon; sid:200006687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.chobqu.cn",nocase; classtype:attempted-recon; sid:200006688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.dccigq.cn",nocase; classtype:attempted-recon; sid:200006689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.gbswz.cn",nocase; classtype:attempted-recon; sid:200006690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.jeewiki.cn",nocase; classtype:attempted-recon; sid:200006691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.pygbw.cn",nocase; classtype:attempted-recon; sid:200006692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqdqnna.ga",nocase; classtype:attempted-recon; sid:200006693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wrap.co",nocase; classtype:attempted-recon; sid:200006694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wriot-alternate.app.link",nocase; classtype:attempted-recon; sid:200006695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wsatex.cf",nocase; classtype:attempted-recon; sid:200006696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wsxwaaaa.web.app",nocase; classtype:attempted-recon; sid:200006697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wtr.hnc888.co",nocase; classtype:attempted-recon; sid:200006698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wu7q5.app.link",nocase; classtype:attempted-recon; sid:200006699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wulalalela.cyou",nocase; classtype:attempted-recon; sid:200006700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvwuniswap.top",nocase; classtype:attempted-recon; sid:200006701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvwv.xn--zonsegurasbn1cmp-hmb1nth.com",nocase; classtype:attempted-recon; sid:200006702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww1.bcponlineapplication.com",nocase; classtype:attempted-recon; sid:200006703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww2.activartusoperacionesenlinea.zonasegurabeta.com.pe.vegam.co",nocase; classtype:attempted-recon; sid:200006704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww25.avisotransacao.com",nocase; classtype:attempted-recon; sid:200006705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww25.d16hdrba6dusey.clouldfront.net",nocase; classtype:attempted-recon; sid:200006706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww25.pancaleswap.com",nocase; classtype:attempted-recon; sid:200006707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww6.wwwviabcp.com",nocase; classtype:attempted-recon; sid:200006708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wwproamerivto.byethost13.com",nocase; classtype:attempted-recon; sid:200006709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-046cw.skipdns.link",nocase; classtype:attempted-recon; sid:200006710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-4ng31.skipdns.link",nocase; classtype:attempted-recon; sid:200006711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-amezon.scnxa-youxajp.shop",nocase; classtype:attempted-recon; sid:200006712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-amozon.scnxa-youxajp.shop",nocase; classtype:attempted-recon; sid:200006713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-axieinfinity.com",nocase; classtype:attempted-recon; sid:200006714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-cursosdigitalesmx-com.filesusr.com",nocase; classtype:attempted-recon; sid:200006715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-dd91n.skipdns.link",nocase; classtype:attempted-recon; sid:200006716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-degelyehuda-org-il.filesusr.com",nocase; classtype:attempted-recon; sid:200006717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-e2g5k.skipdns.link",nocase; classtype:attempted-recon; sid:200006718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200006719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europessign-com.filesusr.com",nocase; classtype:attempted-recon; sid:200006720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-hi9z3.skipdns.link",nocase; classtype:attempted-recon; sid:200006721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-jcb-co-jp.khrtfc.work",nocase; classtype:attempted-recon; sid:200006722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-key-com.test.edgekey.net",nocase; classtype:attempted-recon; sid:200006723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-labanquevoscomptespostalessl.com",nocase; classtype:attempted-recon; sid:200006724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-labanquevoscomptespostawnx.com",nocase; classtype:attempted-recon; sid:200006725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-n2q3r.skipdns.link",nocase; classtype:attempted-recon; sid:200006726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-pancakeswap-finance.com",nocase; classtype:attempted-recon; sid:200006727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-s302y.skipdns.link",nocase; classtype:attempted-recon; sid:200006728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-smbc-co-jp.dhpryg.cn",nocase; classtype:attempted-recon; sid:200006729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-smbc-co-jp.k42v9.cn",nocase; classtype:attempted-recon; sid:200006730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-themekaverse.com",nocase; classtype:attempted-recon; sid:200006731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-zonaseguravia-bcp.com",nocase; classtype:attempted-recon; sid:200006732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.electrumproject.xyz",nocase; classtype:attempted-recon; sid:200006733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www09secure-portal-online.25u.com",nocase; classtype:attempted-recon; sid:200006734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1-kraken.com",nocase; classtype:attempted-recon; sid:200006735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.jp.mecercearci.com",nocase; classtype:attempted-recon; sid:200006736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.jp.menerceaoi.com",nocase; classtype:attempted-recon; sid:200006737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.jp.meoercearei.com",nocase; classtype:attempted-recon; sid:200006738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200006739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.mceercoarei.com",nocase; classtype:attempted-recon; sid:200006740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.micctd.co.jp.edwardkross.com",nocase; classtype:attempted-recon; sid:200006741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.sanmd.carucd.com",nocase; classtype:attempted-recon; sid:200006742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.scmdn.carucd.com",nocase; classtype:attempted-recon; sid:200006743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.jp.etc-merisaria.com",nocase; classtype:attempted-recon; sid:200006744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.jp.mecercearci.com",nocase; classtype:attempted-recon; sid:200006745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.jp.menerceaoi.com",nocase; classtype:attempted-recon; sid:200006746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.jp.meoercearei.com",nocase; classtype:attempted-recon; sid:200006747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200006748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.ml.meiceaood.com",nocase; classtype:attempted-recon; sid:200006749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.sccnd.carucd.com",nocase; classtype:attempted-recon; sid:200006750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.smbc-card.co.jp.dercarit.com",nocase; classtype:attempted-recon; sid:200006751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.smbc-card.co.jp.direasf.com",nocase; classtype:attempted-recon; sid:200006752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.smbc-card.co.jp.direatusa.com",nocase; classtype:attempted-recon; sid:200006753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3-mtbonline.duckdns.org",nocase; classtype:attempted-recon; sid:200006754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.colegiosantaangelamerici.edu.co",nocase; classtype:attempted-recon; sid:200006755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.jp.merecacrii.com",nocase; classtype:attempted-recon; sid:200006756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.lejournaldugrandparis.fr",nocase; classtype:attempted-recon; sid:200006757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.plenainclusion.org",nocase; classtype:attempted-recon; sid:200006758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www5.meecrcnaroi.com",nocase; classtype:attempted-recon; sid:200006759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www59.83.30.70.63.37.23.krakentxy.com",nocase; classtype:attempted-recon; sid:200006760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www6.jp.meurncarci.com",nocase; classtype:attempted-recon; sid:200006761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wwwpancakeswap.top",nocase; classtype:attempted-recon; sid:200006762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wxcefappmobile.com",nocase; classtype:attempted-recon; sid:200006763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wypadki24.e-kei.pl",nocase; classtype:attempted-recon; sid:200006764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wzbnnen.cn",nocase; classtype:attempted-recon; sid:200006765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wzplh.app.link",nocase; classtype:attempted-recon; sid:200006766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"x2mqj8a.app.link",nocase; classtype:attempted-recon; sid:200006767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xaydungtamhoanganh.com",nocase; classtype:attempted-recon; sid:200006768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xbtdangotexxbt.boxmode.io",nocase; classtype:attempted-recon; sid:200006769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xcvbm.hyperphp.com",nocase; classtype:attempted-recon; sid:200006770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xfinityconnect4you.blogspot.com",nocase; classtype:attempted-recon; sid:200006771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xfitpalestre.com",nocase; classtype:attempted-recon; sid:200006772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xfolarankyy.weebly.com",nocase; classtype:attempted-recon; sid:200006773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xgyul.codesandbox.io",nocase; classtype:attempted-recon; sid:200006774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh13v.mjt.lu",nocase; classtype:attempted-recon; sid:200006775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh140.mjt.lu",nocase; classtype:attempted-recon; sid:200006776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh14n.mjt.lu",nocase; classtype:attempted-recon; sid:200006777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh156.mjt.lu",nocase; classtype:attempted-recon; sid:200006778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1ou.mjt.lu",nocase; classtype:attempted-recon; sid:200006779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1pl.mjt.lu",nocase; classtype:attempted-recon; sid:200006780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1u4.mjt.lu",nocase; classtype:attempted-recon; sid:200006781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh7sz.hyperphp.com",nocase; classtype:attempted-recon; sid:200006782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlgt.mjt.lu",nocase; classtype:attempted-recon; sid:200006783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlr4.mjt.lu",nocase; classtype:attempted-recon; sid:200006784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlvl.mjt.lu",nocase; classtype:attempted-recon; sid:200006785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnq.mjt.lu",nocase; classtype:attempted-recon; sid:200006786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnu.mjt.lu",nocase; classtype:attempted-recon; sid:200006787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnv.mjt.lu",nocase; classtype:attempted-recon; sid:200006788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmqu.mjt.lu",nocase; classtype:attempted-recon; sid:200006789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhs02.mjt.lu",nocase; classtype:attempted-recon; sid:200006790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xid-human-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200006791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xiorsil.freecluster.eu",nocase; classtype:attempted-recon; sid:200006792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj333.mjt.lu",nocase; classtype:attempted-recon; sid:200006793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33s.mjt.lu",nocase; classtype:attempted-recon; sid:200006794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33w.mjt.lu",nocase; classtype:attempted-recon; sid:200006795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj3pr.mjt.lu",nocase; classtype:attempted-recon; sid:200006796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45g.mjt.lu",nocase; classtype:attempted-recon; sid:200006797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45o.mjt.lu",nocase; classtype:attempted-recon; sid:200006798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj4og.mjt.lu",nocase; classtype:attempted-recon; sid:200006799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjm7s.mjt.lu",nocase; classtype:attempted-recon; sid:200006800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjmr7.mjt.lu",nocase; classtype:attempted-recon; sid:200006801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xju3s.mjt.lu",nocase; classtype:attempted-recon; sid:200006802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjupr.mjt.lu",nocase; classtype:attempted-recon; sid:200006803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkdwm.csb.app",nocase; classtype:attempted-recon; sid:200006804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkhheue.cn",nocase; classtype:attempted-recon; sid:200006805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkljfg.ml",nocase; classtype:attempted-recon; sid:200006806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xlouert.xyz",nocase; classtype:attempted-recon; sid:200006807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-1a.xyz",nocase; classtype:attempted-recon; sid:200006808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-1b.xyz",nocase; classtype:attempted-recon; sid:200006809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-2a.xyz",nocase; classtype:attempted-recon; sid:200006810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-2b.xyz",nocase; classtype:attempted-recon; sid:200006811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-3a.xyz",nocase; classtype:attempted-recon; sid:200006812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-3b.xyz",nocase; classtype:attempted-recon; sid:200006813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-4a.xyz",nocase; classtype:attempted-recon; sid:200006814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-4b.xyz",nocase; classtype:attempted-recon; sid:200006815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-5a.xyz",nocase; classtype:attempted-recon; sid:200006816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xm-sparkass-onlin-5b.xyz",nocase; classtype:attempted-recon; sid:200006817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xmley.codesandbox.io",nocase; classtype:attempted-recon; sid:200006818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--bankofmerca-3ij68171c.vg",nocase; classtype:attempted-recon; sid:200006819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--banriul-hpb.com",nocase; classtype:attempted-recon; sid:200006820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--banrul-6va49f.com",nocase; classtype:attempted-recon; sid:200006821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--bnkofmerc-qcbee85c.vg",nocase; classtype:attempted-recon; sid:200006822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--empresas-interbnlk-pe-o0b.com",nocase; classtype:attempted-recon; sid:200006823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--empresas-interlbnlk-pe-h3b.com",nocase; classtype:attempted-recon; sid:200006824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--empresas-lnterbnlk-pe-o0b.com",nocase; classtype:attempted-recon; sid:200006825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--gmal-sya.com",nocase; classtype:attempted-recon; sid:200006826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--gmmerezervuar-imb.com",nocase; classtype:attempted-recon; sid:200006827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--ltappen-80a.se",nocase; classtype:attempted-recon; sid:200006828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--metamak-ipb.online",nocase; classtype:attempted-recon; sid:200006829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--mklerian-0za.se",nocase; classtype:attempted-recon; sid:200006830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pacincia-xl-qbb.com",nocase; classtype:attempted-recon; sid:200006831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--rpondeur-sfr2-bhb.yolasite.com",nocase; classtype:attempted-recon; sid:200006832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--rpondeur-vocal12-bqb.yolasite.com",nocase; classtype:attempted-recon; sid:200006833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--ugbd1cbxo23egh.com",nocase; classtype:attempted-recon; sid:200006834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xpixl.me",nocase; classtype:attempted-recon; sid:200006835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xprgjlx.cn",nocase; classtype:attempted-recon; sid:200006836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqhq4.mjt.lu",nocase; classtype:attempted-recon; sid:200006837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3i.mjt.lu",nocase; classtype:attempted-recon; sid:200006838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3n.mjt.lu",nocase; classtype:attempted-recon; sid:200006839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3u.mjt.lu",nocase; classtype:attempted-recon; sid:200006840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xquidish.web.app",nocase; classtype:attempted-recon; sid:200006841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrx6r.mjt.lu",nocase; classtype:attempted-recon; sid:200006842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh1.mjt.lu",nocase; classtype:attempted-recon; sid:200006843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh2.mjt.lu",nocase; classtype:attempted-recon; sid:200006844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxhl.mjt.lu",nocase; classtype:attempted-recon; sid:200006845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xsop5vp0rfd.typeform.com",nocase; classtype:attempted-recon; sid:200006846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xssxxscscssc.000webhostapp.com",nocase; classtype:attempted-recon; sid:200006847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtbnkpro.hostfree.pw",nocase; classtype:attempted-recon; sid:200006848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtio.ch",nocase; classtype:attempted-recon; sid:200006849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtreme80fitness.com",nocase; classtype:attempted-recon; sid:200006850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtw42.mjt.lu",nocase; classtype:attempted-recon; sid:200006851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xwhwpk.cn",nocase; classtype:attempted-recon; sid:200006852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200006853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xybpzme.cn",nocase; classtype:attempted-recon; sid:200006854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyf1.cn",nocase; classtype:attempted-recon; sid:200006855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyproject.xtensio.com",nocase; classtype:attempted-recon; sid:200006856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y3s2ye.webwave.dev",nocase; classtype:attempted-recon; sid:200006857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y768766y.byethost6.com",nocase; classtype:attempted-recon; sid:200006858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yabo12app.cn",nocase; classtype:attempted-recon; sid:200006859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaboshi.com",nocase; classtype:attempted-recon; sid:200006860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoomailprocessing.weebly.com",nocase; classtype:attempted-recon; sid:200006861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoos-initial-project-cf784a.webflow.io",nocase; classtype:attempted-recon; sid:200006862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahooupdatey.weebly.com",nocase; classtype:attempted-recon; sid:200006863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahuomall.square.site",nocase; classtype:attempted-recon; sid:200006864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yairix.github.io",nocase; classtype:attempted-recon; sid:200006865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yalblww.cn",nocase; classtype:attempted-recon; sid:200006866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yalena.me",nocase; classtype:attempted-recon; sid:200006867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yape.greenter.dev",nocase; classtype:attempted-recon; sid:200006868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaqoobi.org",nocase; classtype:attempted-recon; sid:200006869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yashomatithakur.in",nocase; classtype:attempted-recon; sid:200006870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yayanti.com",nocase; classtype:attempted-recon; sid:200006871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yexles.com",nocase; classtype:attempted-recon; sid:200006872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ygdguwg.dgzwtmga.cn",nocase; classtype:attempted-recon; sid:200006873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yiaswqjdtcyeqpvyqthijepeai-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200006874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yilavis725.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200006875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ykyevmqxaktnfgrtuufymkhnce-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200006876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yniswape.com",nocase; classtype:attempted-recon; sid:200006877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yniswaqe.com",nocase; classtype:attempted-recon; sid:200006878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yodebashl.fdrn1trs.xyz",nocase; classtype:attempted-recon; sid:200006879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yodobashi.ylaq.net",nocase; classtype:attempted-recon; sid:200006880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yodobishl.rtimth5z.xyz",nocase; classtype:attempted-recon; sid:200006881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yodobushi.sgkrtm7gd.xyz",nocase; classtype:attempted-recon; sid:200006882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yogeshwarwiremesh.com",nocase; classtype:attempted-recon; sid:200006883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yoplwg2740634.byethost17.com",nocase; classtype:attempted-recon; sid:200006884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yosuboshi.ahtfj3y.xyz",nocase; classtype:attempted-recon; sid:200006885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"young-fog-19ef.dhlupdatedblurnt.workers.dev",nocase; classtype:attempted-recon; sid:200006886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"younitedhearts.org",nocase; classtype:attempted-recon; sid:200006887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yourdeathstar.com",nocase; classtype:attempted-recon; sid:200006888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yourequitytracer.com",nocase; classtype:attempted-recon; sid:200006889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youthtrend.in",nocase; classtype:attempted-recon; sid:200006890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youtudaysmensfoo.byethost31.com",nocase; classtype:attempted-recon; sid:200006891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youwingirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200006892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytco.in",nocase; classtype:attempted-recon; sid:200006893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ythfdsf.aio49f4vsd.workers.dev",nocase; classtype:attempted-recon; sid:200006894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytthn.com",nocase; classtype:attempted-recon; sid:200006895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yubababsks.webcindario.com",nocase; classtype:attempted-recon; sid:200006896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yudoushi.klir0ee.xyz",nocase; classtype:attempted-recon; sid:200006897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yunfcgzglkrwrdd.weebly.com",nocase; classtype:attempted-recon; sid:200006898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yurbtcommsmailrr.square.site",nocase; classtype:attempted-recon; sid:200006899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yuuu6.codesandbox.io",nocase; classtype:attempted-recon; sid:200006900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvaledesoser.t.justns.ru",nocase; classtype:attempted-recon; sid:200006901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvesauzon0-mon-site-web-cheetah.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200006902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvessgaspard-mon-site-web-cheetah.free.builderall.com",nocase; classtype:attempted-recon; sid:200006903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yyrrfcxvvvxx1xxv.weebly.com",nocase; classtype:attempted-recon; sid:200006904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z-pay.biz",nocase; classtype:attempted-recon; sid:200006905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z2qje.codesandbox.io",nocase; classtype:attempted-recon; sid:200006906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z3voicrxxvs.typeform.com",nocase; classtype:attempted-recon; sid:200006907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z965.cn",nocase; classtype:attempted-recon; sid:200006908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zackior99444.weebly.com",nocase; classtype:attempted-recon; sid:200006909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zackselectronics.co.zw",nocase; classtype:attempted-recon; sid:200006910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zacma.bialystok.pl",nocase; classtype:attempted-recon; sid:200006911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zadi.me",nocase; classtype:attempted-recon; sid:200006912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zahlbaum.de",nocase; classtype:attempted-recon; sid:200006913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zanbeel.com",nocase; classtype:attempted-recon; sid:200006914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zapatillasfutbolsala.online",nocase; classtype:attempted-recon; sid:200006915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zekkafreitas-vando-magazine.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200006916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zfhub.com.br",nocase; classtype:attempted-recon; sid:200006917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zhanmaku.com",nocase; classtype:attempted-recon; sid:200006918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zhguanshi.com",nocase; classtype:attempted-recon; sid:200006919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zi-3-gporange1.free.builderall.com",nocase; classtype:attempted-recon; sid:200006920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zimbabwe.net.za",nocase; classtype:attempted-recon; sid:200006921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zimbria.creatorlink.net",nocase; classtype:attempted-recon; sid:200006922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zip10.skipdns.link",nocase; classtype:attempted-recon; sid:200006923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zix-zero.org.ru",nocase; classtype:attempted-recon; sid:200006924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zj87wl.cn",nocase; classtype:attempted-recon; sid:200006925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zlej3mqyoty.typeform.com",nocase; classtype:attempted-recon; sid:200006926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zog1.fast-page.org",nocase; classtype:attempted-recon; sid:200006927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-online.web.app",nocase; classtype:attempted-recon; sid:200006928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-validationserv.web.app",nocase; classtype:attempted-recon; sid:200006929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegura-pichincha.pe-ini.com",nocase; classtype:attempted-recon; sid:200006930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegura-pichincha.pe-nts.com",nocase; classtype:attempted-recon; sid:200006931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguradproductosvialbcp.com",nocase; classtype:attempted-recon; sid:200006932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguran1.bn.virtual.cartinperu.com",nocase; classtype:attempted-recon; sid:200006933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegurapichincha.pe-ini.com",nocase; classtype:attempted-recon; sid:200006934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguridadec.2host.me",nocase; classtype:attempted-recon; sid:200006935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonassegurabetaviabcp.pe-1l.com",nocase; classtype:attempted-recon; sid:200006936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoovita.kz",nocase; classtype:attempted-recon; sid:200006937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zorten.com",nocase; classtype:attempted-recon; sid:200006938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zphum.skipdns.link",nocase; classtype:attempted-recon; sid:200006939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zrewwt.cf",nocase; classtype:attempted-recon; sid:200006940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zscevax.000webhostapp.com",nocase; classtype:attempted-recon; sid:200006941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zvuqh.app.link",nocase; classtype:attempted-recon; sid:200006942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zweqrqa.ga",nocase; classtype:attempted-recon; sid:200006943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zy31tznpdey8ct1kmqdzw32q9-9zgh0dzont5nm3bfwp1yyxiu.glitch.me",nocase; classtype:attempted-recon; sid:200006944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0333fa5.netsolhost.com",nocase; http_uri; content:"/comcast/xfinity.html",nocase; classtype:attempted-recon; sid:200006945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0333fa5.netsolhost.com",nocase; http_uri; content:"/comcast/xfinity.php?d1193169ba22c33594765d16035661b1=&amp\;email=a@a.c&amp\;.rand=login.xfinity.com.aspx",nocase; classtype:attempted-recon; sid:200006946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/",nocase; classtype:attempted-recon; sid:200006947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/iframe-page2.html",nocase; classtype:attempted-recon; sid:200006948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0492d3a.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/vos-remboursements/portailas/",nocase; classtype:attempted-recon; sid:200006949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5134768/serra-es",nocase; classtype:attempted-recon; sid:200006950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5220557/",nocase; classtype:attempted-recon; sid:200006951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5559915/microsoft-team",nocase; classtype:attempted-recon; sid:200006952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5578660/form",nocase; classtype:attempted-recon; sid:200006953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12hjeen9wd.preerbsaistkmrdzkkmjxmqsweerrygext.com",nocase; http_uri; content:"/rd/c507zighu1244882bblg22499hvl7387vciz181",nocase; classtype:attempted-recon; sid:200006954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.15",nocase; http_uri; content:"/?id=http://www.cdph.ca.gov/programs/chcq/lcp/pages/afl-20-33.aspx&amp\;fields=og_object{engagement}&amp\;callback=_ate.cbs.rcb_fiqs0",nocase; classtype:attempted-recon; sid:200006955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200006956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.22.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200006957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!asdoqhdzchzkceksme1zxz0tbys",nocase; classtype:attempted-recon; sid:200006958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!bbfkfubdzlmf4bxyznr20upuimi1?e=bcfamsa3qks2l7lvshve1a&amp\;at=9",nocase; classtype:attempted-recon; sid:200006959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!bdl5r1ki9tc3gqvi-1haort04ahz?e=2lalmxflvewx2tjousf09g&amp\;at=9",nocase; classtype:attempted-recon; sid:200006960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!biwi80oasoewgxoqavzz0prwohuk?e=c-d9fhgd9ue1qswmmond5w&amp\;at=9",nocase; classtype:attempted-recon; sid:200006961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!aihhv-zvscdjhqsdischj90qlymy?e=niqich",nocase; classtype:attempted-recon; sid:200006962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!aklt5-l7t4i2xvktl7g9mdgfcknm?e=cfngyw",nocase; classtype:attempted-recon; sid:200006963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!aqzh3mzuvkddmbmdyu98fbfw9doy?e=mdjorx",nocase; classtype:attempted-recon; sid:200006964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!auzzdh9o3pd3cutlhnbnixde2iu?e=bypust",nocase; classtype:attempted-recon; sid:200006965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/w/s!aguoqd84zse3gt7r1mqpd90amvv3",nocase; classtype:attempted-recon; sid:200006966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/w/s!at6abcmxoqeqgrrahazju3fo1ojj",nocase; classtype:attempted-recon; sid:200006967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/xs/s!am4xl7rvugywaxod-4xmpezy4mk?wdformid=%7ba1c5478a-c065-4b6f-b415-c1a0973f4392%7d%3e",nocase; classtype:attempted-recon; sid:200006968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"377080202567359722137708020256735972.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200006969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3rdstreetmarket.com",nocase; http_uri; content:"/wp-content/themes/3rdst/8-login-form/",nocase; classtype:attempted-recon; sid:200006970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"44.72.132.34.bc.googleusercontent.com",nocase; http_uri; content:"/expira/?hash=?cliente=osmar.carvalho@outlook.com",nocase; classtype:attempted-recon; sid:200006971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200006972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99images.com",nocase; http_uri; content:"/apps/ios-education/1518046536",nocase; classtype:attempted-recon; sid:200006973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-q-f.com",nocase; http_uri; content:"/openpc/directlogin.do",nocase; classtype:attempted-recon; sid:200006974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aadaedu-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/sherring_aada_edu1/epxaaqphuzvnqoye4vgldzkbzmud1mij-ek8r72wltpdyq?e=szm5ky",nocase; classtype:attempted-recon; sid:200006975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abnmart.co.in",nocase; http_uri; content:"/orne/",nocase; classtype:attempted-recon; sid:200006976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt",nocase; classtype:attempted-recon; sid:200006977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?passive=1209600&osid=1&continue=https://plus.google.com/%26&followup=https://plus.google.com/%26",nocase; classtype:attempted-recon; sid:200006978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&amp\;passive=1209600&amp\;continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&amp\;followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200006979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html",nocase; classtype:attempted-recon; sid:200006980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html",nocase; classtype:attempted-recon; sid:200006981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html",nocase; classtype:attempted-recon; sid:200006983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm&followup=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm",nocase; classtype:attempted-recon; sid:200006984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html&followup=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html",nocase; classtype:attempted-recon; sid:200006985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200006986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/user517497679326978.appspot.com/index.html&followup=https://storage.cloud.google.com/user517497679326978.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/user7773578ixh1092839.appspot.com/index.html&followup=https://storage.cloud.google.com/user7773578ixh1092839.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/xzrdzcdruerp.appspot.com/index.html&followup=https://storage.cloud.google.com/xzrdzcdruerp.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adoptology.org",nocase; http_uri; content:"/appppssss/wells.connect/login/sign%20on.html?origin=identity",nocase; classtype:attempted-recon; sid:200006990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/admin/support/inv/ver/app/index",nocase; classtype:attempted-recon; sid:200006991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/674f82e5abe83f264a9ed2fe302c5756/secureaccount.php?country.x=gb&amp\;locale.x=en_gb&amp\;customer.x=id-pa$1$anytl6pc$grtl1s/gj4jgysgla3yof1&amp\;safety=cz7je26a5ivycnle8c65dbqcbke0whmo31xtx0gzcd03ufwm5895a2eippbr33rs4e3bkohn20fyudq6a9vsj774tl0fg8/css/paypalsansbig-light.svg",nocase; classtype:attempted-recon; sid:200006992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/becc1dd370c40fc36d97ac749acceaa3/secureaccount.php?country.x=gb&amp\;locale.x=en_gb&amp\;customer.x=id-pa$1$57rbqkxx$vhibd4l3vr3tfnfffdrq/1&amp\;safety=pzv8t4dneidf8cc99spbcko3egb9xfjend513b402uoa2eiwacabam1rug7xm6k4y0w9f1dcqhfs111yhlaj7t0vrzl6q1/css/paypalsansbig-light.woff",nocase; classtype:attempted-recon; sid:200006993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/becc1dd370c40fc36d97ac749acceaa3/secureaccount.php?country.x=gb&locale.x=en_gb&customer.x=id-pa$1$57rbqkxx$vhibd4l3vr3tfnfffdrq/1&safety=pzv8t4dneidf8cc99spbcko3egb9xfjend513b402uoa2eiwacabam1rug7xm6k4y0w9f1dcqhfs111yhlaj7t0vrzl6q1",nocase; classtype:attempted-recon; sid:200006994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aijcs.blogspot.com",nocase; http_uri; content:"/2005/03/colourful-life-of-aij.html",nocase; classtype:attempted-recon; sid:200006995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"airbrakes-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/fran_airbrake_ie/eqc3jfpbonbnqnibgpaej70bhh4buhabliuakttnd6zeyq?e=szvft8",nocase; classtype:attempted-recon; sid:200006996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alconexport.com",nocase; http_uri; content:"/ion",nocase; classtype:attempted-recon; sid:200006997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alconexport.com",nocase; http_uri; content:"/ion/",nocase; classtype:attempted-recon; sid:200006998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerttnow.com",nocase; http_uri; content:"/landing/form/f774c094-fd52-4c02-933e-72d2164c084f",nocase; classtype:attempted-recon; sid:200006999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfredtalkelogisticservices-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/venus_gardose_talke_com/_layouts/15/wopiframe.aspx?guestaccesstoken=8extkunxrkqozifs2sycqmk4ox0ntao7cizsavm5mjc=&amp\;docid=1_14abcf62971634e6b8387df30ef7d978b&amp\;wdformid={83a6cfc0-5689-4aa4-ab13-96952b8999ba}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliah.ac.in",nocase; http_uri; content:"/2n020/setmodule/",nocase; classtype:attempted-recon; sid:200007001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alinachopra.com",nocase; http_uri; content:"/blog/wp-content/themes/10/",nocase; classtype:attempted-recon; sid:200007002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allnewhaircut.com",nocase; http_uri; content:"/smi.cers/bmss.php",nocase; classtype:attempted-recon; sid:200007003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alternanetworks-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/thomas_salemkour_open-xerox_com/eq5ps-07ovvnl5eo4rrthymb7a9euvzss3urntui3dvyyq?e=kqnstw",nocase; classtype:attempted-recon; sid:200007004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambrosecourt.com",nocase; http_uri; content:"/our/ourtime/ourtime.html",nocase; classtype:attempted-recon; sid:200007005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amenainvest-my.sharepoint.com",nocase; http_uri; content:"/personal/sebastiangerlach_amena-invest_de/_layouts/15/authenticate.aspx",nocase; classtype:attempted-recon; sid:200007006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/6svmmslahsbulanefidruivssz4/index.html",nocase; classtype:attempted-recon; sid:200007007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/leacockpaving1/index.html",nocase; classtype:attempted-recon; sid:200007008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/libertyfrac23iuy3r87/index.html",nocase; classtype:attempted-recon; sid:200007009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/njk/25_40_24_5e_40_26_40_26_28_29_23_23_5e_23_24_26_5e_25_26_40_5e_28_23_26.html",nocase; classtype:attempted-recon; sid:200007010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anekaslot.com",nocase; http_uri; content:"/jps/webmail_reset.htm",nocase; classtype:attempted-recon; sid:200007011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200007012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe2.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200007013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anniewright-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mary_belisle_aw_org/_layouts/15/wopiframe.aspx?guestaccesstoken=rxpjqbfln4drfnv4sgfnnqwyldsjbnceldcpqdpe7hu%3d&docid=1_120e0a15e74f24c589d87788d99c1c667&wdformid=%7b493b5cd7%2d227e%2d4339%2d98b3%2da8644c8ce588%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly93zxetnmrlodiud2vilmfwcc8znzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxi5lze1lziwmjeznzg1mjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxiznzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu0znzg1mjf3zwjtyxn0zxi5lze1lziwmjfjdw5plmn6nto1nibbttm3oduymtu6ntygqu13zwjtyxn0zxiznzg1mjejd2vibwfzdgvyqgn1bmkuy3o=",nocase; classtype:attempted-recon; sid:200007015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly9ua3yuchvil3h5nt83oet4elzsag1mzndzjmfsdd1tzwrpysnav2x0wvhomfpvqnpkr2x1y0hkcgvtrxvim0puolbcy3ppmu4yzgrladg2ennfduhvdu02qxphujjmuhv5zw5ork5ecvu=",nocase; classtype:attempted-recon; sid:200007016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=37248906&amp\;s1=2d8a1db7066ae145-5e70fb7b763882480f1ffb01&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200007017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96574574&amp\;s1=d2cb2653d154e850-5ea5960ca629f275326f9e81&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200007018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96668170&amp\;s1=2b94eb26dd71a6e0-5ea5961f20937a71e917f602&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200007019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkfun.com",nocase; http_uri; content:"/reale-seguros.html",nocase; classtype:attempted-recon; sid:200007020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkun.com",nocase; http_uri; content:"/v/credixworld",nocase; classtype:attempted-recon; sid:200007021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/43l7nxncafyxdiaecwxblt0yo2hn7epz",nocase; classtype:attempted-recon; sid:200007022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/aju8uu3l7x4uusi7v53z09uk6rvwd161",nocase; classtype:attempted-recon; sid:200007023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/b9fu9axf9rcv7bhjp80fpcm8zna5wcwi",nocase; classtype:attempted-recon; sid:200007024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/bog5q0dw9nxw2zs7e01m5y6zw23oeszj",nocase; classtype:attempted-recon; sid:200007025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl",nocase; classtype:attempted-recon; sid:200007026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4",nocase; classtype:attempted-recon; sid:200007027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.digitaledunet.com",nocase; http_uri; content:"/bin/connect.api.bank.of.america.com.secure.auth.dashboard.auto.sign.in.user.info.webmai1.id/b0fa/4da68e36/",nocase; classtype:attempted-recon; sid:200007028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pandadoc.com",nocase; http_uri; content:"/p/96f48ddb9415f1307e22c50a18ad07c1785a5164?",nocase; classtype:attempted-recon; sid:200007029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pipefy.com",nocase; http_uri; content:"/public/form/lzlobsi_",nocase; classtype:attempted-recon; sid:200007030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/22f3qw",nocase; classtype:attempted-recon; sid:200007031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/cmxgsj",nocase; classtype:attempted-recon; sid:200007032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/lhwhl9",nocase; classtype:attempted-recon; sid:200007033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200007034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/2skowwypyb",nocase; classtype:attempted-recon; sid:200007035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/6dfhh1yrol",nocase; classtype:attempted-recon; sid:200007036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/fuppf4qa9u",nocase; classtype:attempted-recon; sid:200007037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/gwcwfaxmun",nocase; classtype:attempted-recon; sid:200007038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/izmlfzanc-",nocase; classtype:attempted-recon; sid:200007039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/k8hy2cvo8x",nocase; classtype:attempted-recon; sid:200007040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/lsmho6dyl-",nocase; classtype:attempted-recon; sid:200007041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/wywajnlbtl",nocase; classtype:attempted-recon; sid:200007042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/xiwmghfmg3",nocase; classtype:attempted-recon; sid:200007043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archive.behappyevent.com",nocase; http_uri; content:"/dnes_9s?tdx_br=a4fwlnblbgkcla6mwjyyaiz1ykkkwkzfamcaqhy0j2ljagriypuu/margareta.nordstrand%40er.lu.se",nocase; classtype:attempted-recon; sid:200007044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archive.behappyevent.com",nocase; http_uri; content:"/tvok_6r?kha_dn=a4fwlnfrbgkclyv1wm5paicjykcdomzjb4crpx9xkwpfbgkjy31yjmpkaigd/norzaihan.norhashim@qsrbrands.com.my",nocase; classtype:attempted-recon; sid:200007045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arisebuildscom-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/gene_arisebuilds_com/eggkjirnlknoh4k8dkclnxcbpfg-oj1ihz4vpywlomnezw?e=gqgvfz",nocase; classtype:attempted-recon; sid:200007046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aro365539014-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/brittany_rivertownfinance_com/ebd7xlmfefbajikalhwkrw4bj9qm2y55sehnafmgtfcdvg?e=4*3ariqguh&amp\;at=9",nocase; classtype:attempted-recon; sid:200007047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php",nocase; classtype:attempted-recon; sid:200007048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php?starten=4geqwfau8kaypmmfbcrv0zhhxbrd7q&amp\;shuffluri?=csmdd37bht6zgxq2ijem",nocase; classtype:attempted-recon; sid:200007049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assoalhosmadeiras.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200007050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atmostechnology-my.sharepoint.com",nocase; http_uri; content:"/personal/amalia_atmostechnology_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=uiyaiqprc2ikxq0mezirqthais%2fdp9mp1hyqhjkscj0%3d&docid=1_1cbd4797f2749435a8f30af1a3f2d36b5&wdformid=%7b890161c9%2deb6d%2d44fc%2d9a59%2d0e4400a27203%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=f77ihhc%2fxkig6gfhqiddogtmjqoxm0%2fq%2bb2euyif%2bri%3d&docid=1_1c9c826e0945c4aae87a3cf1547b535ab&wdformid=%7b3565fd77%2dd37d%2d4ccf%2db660%2d25cb35a12799%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay=&amp\;docid=1_10932d3dd2ac2478f833ee56388ecb767&amp\;wdformid={faebec1d-bc38-42bf-be94-47ebb62d7501}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=f77ihhc%2fxkig6gfhqiddogtmjqoxm0%2fq%2bb2euyif%2bri%3d&docid=1_1c9c826e0945c4aae87a3cf1547b535ab&wdformid=%7b3565fd77%2dd37d%2d4ccf%2db660%2d25cb35a12799%7d&action=formsubmit&cid=f76562aa-9283-40ef-8ac9-15e5e7722d9b",nocase; classtype:attempted-recon; sid:200007054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay%3d&docid=1_10932d3dd2ac2478f833ee56388ecb767&wdformid=%7bfaebec1d%2dbc38%2d42bf%2dbe94%2d47ebb62d7501%7d&action=formsubmit&cid=06548627-9647-42de-a0c7-75a424aaacde",nocase; classtype:attempted-recon; sid:200007055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay=&amp\;docid=1_10932d3dd2ac2478f833ee56388ecb767&amp\;wdformid={faebec1d-bc38-42bf-be94-47ebb62d7501}&amp\;action=formsubmit&amp\;cid=06548627-9647-42de-a0c7-75a424aaacde",nocase; classtype:attempted-recon; sid:200007056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att-yahoo.meculinkvolt.com",nocase; http_uri; content:"/at&amp\;t",nocase; classtype:attempted-recon; sid:200007057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att-yahoo.meculinkvolt.com",nocase; http_uri; content:"/at&t/",nocase; classtype:attempted-recon; sid:200007058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attemptdetectedpayment.com",nocase; http_uri; content:"/lloydsbank",nocase; classtype:attempted-recon; sid:200007059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auduboninstitute-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/kramsey_auduboninstitute_org/evesqu6pzsxojjljb-ygjewbwb6dv_wn9ebmuzghm1jkbw?e=bcysta",nocase; classtype:attempted-recon; sid:200007060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth34567898765434567898765432345678765432345678765433456987654.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/98765rfghui987654ew67uhgfder56u765rdfghu765rfghu765rfghjui8765rtfghji8765rew34567uhgfder4567ujhgfr5678iujhgt678jhgfrt67uhgfrt567uhgfr67uhgfrt6uiuytrfghjui876ytfgbhjkiuyt/mine-login-09876trfghjio9876trfdvbhjkioytrfcvbnhjkiuytrdsertyhbvcdftyuytrfdvghyytrfghjuytfrdrtyhgvcdfrtyhjbvcdfrtyjkiutrdcvbnjuytrdwe4567uhvcxservcrtyu.html?alt=media&token=eceadc54-a951-44b8-ae51-18aaf8c8e92f&pgxosrktfxflmqhiy0ixqnpncwatb4dadjorhwkldb204sft55=hiiu6o2t7gcxveamuujb&email=abuse@ionos.com&bzeemuogiud0xlfyomaiwh6saws0dg3zxrhtmpufkv9yrketkjrw5bu4bhkrkfzctvsvt9qwmliszj13o5qwnuabaaq8bknruxt1",nocase; classtype:attempted-recon; sid:200007061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth34567898765434567898765432345678765432345678765433456987654.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/98765rfghui987654ew67uhgfder56u765rdfghu765rfghu765rfghjui8765rtfghji8765rew34567uhgfder4567ujhgfr5678iujhgt678jhgfrt67uhgfrt567uhgfr67uhgfrt6uiuytrfghjui876ytfgbhjkiuyt/mine-login-09876trfghjio9876trfdvbhjkioytrfcvbnhjkiuytrdsertyhbvcdftyuytrfdvghyytrfghjuytfrdrtyhgvcdfrtyhjbvcdfrtyjkiutrdcvbnjuytrdwe4567uhvcxservcrtyu.html?alt=media&token=eceadc54-a951-44b8-ae51-18aaf8c8e92f&pgxosrktfxflmqhiy0ixqnpncwatb4dadjorhwkldb204sft55=hiiu6o2t7gcxveamuujb&email=redacted@abuse.ionos.com&bzeemuogiud0xlfyomaiwh6saws0dg3zxrhtmpufkv9yrketkjrw5bu4bhkrkfzctvsvt9qwmliszj13o5qwnuabaaq8bknruxt1",nocase; classtype:attempted-recon; sid:200007062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authorsationsetting-lloydsmanagement.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200007063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awdescargas.com",nocase; http_uri; content:"/peliculas",nocase; classtype:attempted-recon; sid:200007064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azeioaz.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200007065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ballost.org",nocase; http_uri; content:"/barbara_palvinic_breakingnews/?a=barbara_palvin&amp\;p=bitcoin_prime&amp\;cep=qra0tipfgaboldz77_jbsy_ezw3obpceykaqvhypvbzx7xzkctmjl0begcfdvwvcxytsr6voipvtjqtcmvyqhqj-m1fziqmka5jed0jfi4yld_pks1-s4hv7nmw3-chwol7szgua0lpcfcwkjbrktdpcvmtnqrzc2lpkupgrhk-voxqdxv5ihshklxa8kggze-pgbjahdbpwgter8zynuvlcxtjh8uaburxdgcnajygihskbucpqxlamo_qzrmcei8xl4jd3sy4lmwyphk4vwl63-ftji72xhoq0pj5iwxpgc7gdwdyznauhtxf-iyhp0s9yxrnlzsl4v4anyu89q-j8zlx0mfj_8na1q2mjqtjfyxiu8bvg0exrhzo-3gy6-vdhage13eudintavhvlfontd-qbjywx5nhik-6xm4u-yvtfvpmd_jnkkvf515r05pd1loyc_themttltp0dznp3wpgwfq6-lzhhvy9jwboql8avkg6d1wrw1pahkfif_n36hviyjvmlfivfstiqcepp65cbnti6kqhiysjuwieb72zcxnftjjocm3egaeiw&amp\;lptoken=16f22589212161c89401&amp\;keyword=job+search+&amp\;geo=hu&amp\;campaignname=hu+dp+desktop+asap&amp\;device=desktop&amp\;os=windows+10&amp\;browser=firefox+89&amp\;carrier=unknown&amp\;source=434214235&amp\;bid=0.0065&amp\;clickid=86368833580",nocase; classtype:attempted-recon; sid:200007066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bamboobypanda.com",nocase; http_uri; content:"/r",nocase; classtype:attempted-recon; sid:200007067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses",nocase; classtype:attempted-recon; sid:200007068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses/",nocase; classtype:attempted-recon; sid:200007069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankofguart.com",nocase; http_uri; content:"/on/",nocase; classtype:attempted-recon; sid:200007070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baovesusonglcxt.com",nocase; http_uri; content:"/wp-includes/index.html",nocase; classtype:attempted-recon; sid:200007071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bardaiconnect.com",nocase; http_uri; content:"/app/listeners/ae/n-nv6588123/ae/ae/verify/sms.php",nocase; classtype:attempted-recon; sid:200007072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=1cf04e9f-706e-0000-469d-3c7942c5beb8&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1ozy1mtmjqdjewzw&amp\;cid=81889f02-24c2-4efa-9e1e-1ccac075a22c",nocase; classtype:attempted-recon; sid:200007073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=3d693f9f-20ed-0000-3f04-fe0e8f6dfa87&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae",nocase; classtype:attempted-recon; sid:200007074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=5961409f-c08a-0000-3fa1-75b979fb3192&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1yac0ycxkzttewzw&amp\;cid=c5f1ae7f-ac1c-4323-a07c-260e95800ab9",nocase; classtype:attempted-recon; sid:200007075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=59d2529f-d007-0000-3f10-e11b5cf398b3&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt0zdnbfaxpqntewzw&amp\;cid=57281b4c-f8f3-415a-b048-b94ef5111d89",nocase; classtype:attempted-recon; sid:200007076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=62d2529f-7028-0000-3f04-f6b0a072a22a&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1jx3ktb1rqntewzw&amp\;cid=619fb8f1-b627-419b-80b1-cfd7e7cfa29b",nocase; classtype:attempted-recon; sid:200007077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=7927489f-2081-0000-4704-eb1a7ea7761d&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt0zeg04whlqzjewzw&amp\;cid=69a9adbf-9a76-4925-abca-a25903c1383e",nocase; classtype:attempted-recon; sid:200007078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%209vcodtblni2sahsdqci9c/qyr4=&amp\;docid=1_11dad9ed160d14dafa586323403d7fef8&amp\;wdformid={62e5338c-c4ba-43fd-ab98-d884748022e2}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%2b9vcodtblni2sahsdqci9c%2fqyr4%3d&docid=1_11dad9ed160d14dafa586323403d7fef8&wdformid=%7b62e5338c%2dc4ba%2d43fd%2dab98%2dd884748022e2%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200007080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%2b9vcodtblni2sahsdqci9c%2fqyr4%3d&docid=1_11dad9ed160d14dafa586323403d7fef8&wdformid=%7b62e5338c%2dc4ba%2d43fd%2dab98%2dd884748022e2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautiful.ai",nocase; http_uri; content:"/player/-mo5kfkhvmaernvnoo_o",nocase; classtype:attempted-recon; sid:200007082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautiful.ai",nocase; http_uri; content:"/player/-mo5kfkhvmaernvnoo_o/pre-review",nocase; classtype:attempted-recon; sid:200007083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautiful.ai",nocase; http_uri; content:"/player/-mo8qn3pfsj6hlhwxavm",nocase; classtype:attempted-recon; sid:200007084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautiful.ai",nocase; http_uri; content:"/player/-mo8qn3pfsj6hlhwxavm/ocean-review",nocase; classtype:attempted-recon; sid:200007085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus022.blogspot.com",nocase; http_uri; content:"//",nocase; classtype:attempted-recon; sid:200007086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhd-leon-do.eshost.com.ar",nocase; http_uri; content:"/?i=1",nocase; classtype:attempted-recon; sid:200007087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biolinky.co",nocase; http_uri; content:"/exodusmobile",nocase; classtype:attempted-recon; sid:200007088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/8asqs4",nocase; classtype:attempted-recon; sid:200007089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/aanmeiden-mobile",nocase; classtype:attempted-recon; sid:200007090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fgday",nocase; classtype:attempted-recon; sid:200007091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fjxoo",nocase; classtype:attempted-recon; sid:200007092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fl4ss",nocase; classtype:attempted-recon; sid:200007093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fq8j7",nocase; classtype:attempted-recon; sid:200007094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fq8ka",nocase; classtype:attempted-recon; sid:200007095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3kf",nocase; classtype:attempted-recon; sid:200007096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3wr",nocase; classtype:attempted-recon; sid:200007097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xl",nocase; classtype:attempted-recon; sid:200007098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xm",nocase; classtype:attempted-recon; sid:200007099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xt",nocase; classtype:attempted-recon; sid:200007100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xv",nocase; classtype:attempted-recon; sid:200007101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xw",nocase; classtype:attempted-recon; sid:200007102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr5gr",nocase; classtype:attempted-recon; sid:200007103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr6ci",nocase; classtype:attempted-recon; sid:200007104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frbmx",nocase; classtype:attempted-recon; sid:200007105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frcsy",nocase; classtype:attempted-recon; sid:200007106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frdxo",nocase; classtype:attempted-recon; sid:200007107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frgpu",nocase; classtype:attempted-recon; sid:200007108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frme6",nocase; classtype:attempted-recon; sid:200007109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frn5x",nocase; classtype:attempted-recon; sid:200007110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/froaf",nocase; classtype:attempted-recon; sid:200007111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frp2n",nocase; classtype:attempted-recon; sid:200007112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frpqv",nocase; classtype:attempted-recon; sid:200007113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frs5v",nocase; classtype:attempted-recon; sid:200007114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frsfc",nocase; classtype:attempted-recon; sid:200007115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frstw",nocase; classtype:attempted-recon; sid:200007116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frtqa",nocase; classtype:attempted-recon; sid:200007117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frx8b",nocase; classtype:attempted-recon; sid:200007118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxca",nocase; classtype:attempted-recon; sid:200007119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxsz",nocase; classtype:attempted-recon; sid:200007120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxwh",nocase; classtype:attempted-recon; sid:200007121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygn",nocase; classtype:attempted-recon; sid:200007122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygp",nocase; classtype:attempted-recon; sid:200007123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygr",nocase; classtype:attempted-recon; sid:200007124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fryhj",nocase; classtype:attempted-recon; sid:200007125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsdzf",nocase; classtype:attempted-recon; sid:200007126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsf6l",nocase; classtype:attempted-recon; sid:200007127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsflz",nocase; classtype:attempted-recon; sid:200007128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsg2h",nocase; classtype:attempted-recon; sid:200007129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsnyd",nocase; classtype:attempted-recon; sid:200007130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsokg",nocase; classtype:attempted-recon; sid:200007131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fspo6",nocase; classtype:attempted-recon; sid:200007132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsqyz",nocase; classtype:attempted-recon; sid:200007133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fss6n",nocase; classtype:attempted-recon; sid:200007134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fswcj",nocase; classtype:attempted-recon; sid:200007135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/sona994",nocase; classtype:attempted-recon; sid:200007136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/tup994",nocase; classtype:attempted-recon; sid:200007137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/vmail-att-net",nocase; classtype:attempted-recon; sid:200007138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly.",nocase; http_uri; content:"/3ijwsm2",nocase; classtype:attempted-recon; sid:200007139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2iz03nf",nocase; classtype:attempted-recon; sid:200007140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2kduy2u",nocase; classtype:attempted-recon; sid:200007141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nog4ow?facebook_update",nocase; classtype:attempted-recon; sid:200007142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nwrbgj",nocase; classtype:attempted-recon; sid:200007143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2oq6dhz",nocase; classtype:attempted-recon; sid:200007144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2p28z0h",nocase; classtype:attempted-recon; sid:200007145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2q7fcpg",nocase; classtype:attempted-recon; sid:200007146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2spto3d",nocase; classtype:attempted-recon; sid:200007147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2uwvcnh",nocase; classtype:attempted-recon; sid:200007148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2vuwbzk",nocase; classtype:attempted-recon; sid:200007149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2we8ivg?facebook_update",nocase; classtype:attempted-recon; sid:200007150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wqlrea",nocase; classtype:attempted-recon; sid:200007151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wwa0gq",nocase; classtype:attempted-recon; sid:200007152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2yd7lnq",nocase; classtype:attempted-recon; sid:200007153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2yuidjh?/facebookhelp",nocase; classtype:attempted-recon; sid:200007154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zaee65",nocase; classtype:attempted-recon; sid:200007155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zejaht",nocase; classtype:attempted-recon; sid:200007156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zomh31?confirmation",nocase; classtype:attempted-recon; sid:200007157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zu47a1",nocase; classtype:attempted-recon; sid:200007158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zu47a1?=/https://internetbanking.caixa.gov.br",nocase; classtype:attempted-recon; sid:200007159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3067hnm",nocase; classtype:attempted-recon; sid:200007160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30aztuq",nocase; classtype:attempted-recon; sid:200007161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30dwddq",nocase; classtype:attempted-recon; sid:200007162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/310rtwp",nocase; classtype:attempted-recon; sid:200007163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/319qtui",nocase; classtype:attempted-recon; sid:200007164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31cwtqd?facebook_update",nocase; classtype:attempted-recon; sid:200007165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31d3mp6?facebook_service",nocase; classtype:attempted-recon; sid:200007166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31khpkz",nocase; classtype:attempted-recon; sid:200007167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/33ipjf7",nocase; classtype:attempted-recon; sid:200007168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/34mhgdg",nocase; classtype:attempted-recon; sid:200007169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/35qrdnc",nocase; classtype:attempted-recon; sid:200007170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/37r8zo3",nocase; classtype:attempted-recon; sid:200007171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38xmo4d",nocase; classtype:attempted-recon; sid:200007172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/392hszz",nocase; classtype:attempted-recon; sid:200007173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aetm80",nocase; classtype:attempted-recon; sid:200007174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3afo6kx",nocase; classtype:attempted-recon; sid:200007175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3an4lcn",nocase; classtype:attempted-recon; sid:200007176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aqvwmn",nocase; classtype:attempted-recon; sid:200007177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3atljjk",nocase; classtype:attempted-recon; sid:200007178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3b4sqa1",nocase; classtype:attempted-recon; sid:200007179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bbkocy",nocase; classtype:attempted-recon; sid:200007180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bdkpfx?facebook_update",nocase; classtype:attempted-recon; sid:200007181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bmjhx1?confirmation",nocase; classtype:attempted-recon; sid:200007182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bpmex0",nocase; classtype:attempted-recon; sid:200007183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bq4stv?confirmation",nocase; classtype:attempted-recon; sid:200007184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bsgkin",nocase; classtype:attempted-recon; sid:200007185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3btopnn",nocase; classtype:attempted-recon; sid:200007186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bv7pr1",nocase; classtype:attempted-recon; sid:200007187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bvwofv?confirmation",nocase; classtype:attempted-recon; sid:200007188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bygqiw?/page-confirmation",nocase; classtype:attempted-recon; sid:200007189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3c0wtbp",nocase; classtype:attempted-recon; sid:200007190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3c6ejk6",nocase; classtype:attempted-recon; sid:200007191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cahvv5help-center-notice-comunity",nocase; classtype:attempted-recon; sid:200007192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cdz7o7",nocase; classtype:attempted-recon; sid:200007193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3clopj4",nocase; classtype:attempted-recon; sid:200007194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cpdic3",nocase; classtype:attempted-recon; sid:200007195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cvl6ir",nocase; classtype:attempted-recon; sid:200007196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3czqfzo?confirmation",nocase; classtype:attempted-recon; sid:200007197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3d7ezub?facebook_update",nocase; classtype:attempted-recon; sid:200007198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3dj0r1p",nocase; classtype:attempted-recon; sid:200007199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ejh45a",nocase; classtype:attempted-recon; sid:200007200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3eszy4w",nocase; classtype:attempted-recon; sid:200007201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3etyqrc?https=f.com",nocase; classtype:attempted-recon; sid:200007202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ezpelh",nocase; classtype:attempted-recon; sid:200007203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fb9f8f",nocase; classtype:attempted-recon; sid:200007204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fk3blu",nocase; classtype:attempted-recon; sid:200007205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3gyfnlm?confirmation",nocase; classtype:attempted-recon; sid:200007206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3h6xtm8",nocase; classtype:attempted-recon; sid:200007207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hc0mxb",nocase; classtype:attempted-recon; sid:200007208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3i8tjul",nocase; classtype:attempted-recon; sid:200007209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3icv8om",nocase; classtype:attempted-recon; sid:200007210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jow35g?confirmation",nocase; classtype:attempted-recon; sid:200007211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqenzp?facebook_update",nocase; classtype:attempted-recon; sid:200007212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqfusj?confirmation",nocase; classtype:attempted-recon; sid:200007213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqmbfu",nocase; classtype:attempted-recon; sid:200007214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jvodhm?confirmation",nocase; classtype:attempted-recon; sid:200007215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jxszq1?confirmation",nocase; classtype:attempted-recon; sid:200007216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3k2aaqc?facebook_update",nocase; classtype:attempted-recon; sid:200007217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kpzhnn",nocase; classtype:attempted-recon; sid:200007218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kueruz",nocase; classtype:attempted-recon; sid:200007219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kv786c",nocase; classtype:attempted-recon; sid:200007220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kwxljh?/help/pages?ref=1",nocase; classtype:attempted-recon; sid:200007221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kxfgbu",nocase; classtype:attempted-recon; sid:200007222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kyxj2w?facebook_update",nocase; classtype:attempted-recon; sid:200007223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ldovbh",nocase; classtype:attempted-recon; sid:200007224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lgmoqh",nocase; classtype:attempted-recon; sid:200007225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mcvvxw",nocase; classtype:attempted-recon; sid:200007226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mgij5v",nocase; classtype:attempted-recon; sid:200007227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mkihc9",nocase; classtype:attempted-recon; sid:200007228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mryk6q",nocase; classtype:attempted-recon; sid:200007229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mvat1h?confirmation",nocase; classtype:attempted-recon; sid:200007230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mwnmia?confirmation",nocase; classtype:attempted-recon; sid:200007231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3n1hcnm",nocase; classtype:attempted-recon; sid:200007232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nicrtr",nocase; classtype:attempted-recon; sid:200007233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nvr2mn",nocase; classtype:attempted-recon; sid:200007234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3o4jvkk",nocase; classtype:attempted-recon; sid:200007235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3oclqbz",nocase; classtype:attempted-recon; sid:200007236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3omn5jp",nocase; classtype:attempted-recon; sid:200007237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3pasn1q",nocase; classtype:attempted-recon; sid:200007238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ppz5l4",nocase; classtype:attempted-recon; sid:200007239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3pqid6z?confirmation",nocase; classtype:attempted-recon; sid:200007240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qc8jtv",nocase; classtype:attempted-recon; sid:200007241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3reovvv",nocase; classtype:attempted-recon; sid:200007242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3swpxho",nocase; classtype:attempted-recon; sid:200007243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tks2um",nocase; classtype:attempted-recon; sid:200007244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tzc89x",nocase; classtype:attempted-recon; sid:200007245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3vtbyq5",nocase; classtype:attempted-recon; sid:200007246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3vyh0x9",nocase; classtype:attempted-recon; sid:200007247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3w8ru6g?confirmation",nocase; classtype:attempted-recon; sid:200007248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3wb6m3i",nocase; classtype:attempted-recon; sid:200007249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3wg1wmb?/page-confirmation",nocase; classtype:attempted-recon; sid:200007250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3witpuj",nocase; classtype:attempted-recon; sid:200007251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zbo8qj",nocase; classtype:attempted-recon; sid:200007252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/banca_mps",nocase; classtype:attempted-recon; sid:200007253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/bancamps-web",nocase; classtype:attempted-recon; sid:200007254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/click-confirm",nocase; classtype:attempted-recon; sid:200007255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/coinspot-claim-bonus",nocase; classtype:attempted-recon; sid:200007256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/community-details",nocase; classtype:attempted-recon; sid:200007257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/conection923781",nocase; classtype:attempted-recon; sid:200007258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/confirm-click",nocase; classtype:attempted-recon; sid:200007259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/edoardopolaccoufficiale",nocase; classtype:attempted-recon; sid:200007260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/id-lockpages",nocase; classtype:attempted-recon; sid:200007261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/id-locksystem",nocase; classtype:attempted-recon; sid:200007262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/informativa-sicurezza-web+",nocase; classtype:attempted-recon; sid:200007263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/issue-community",nocase; classtype:attempted-recon; sid:200007264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/lrs-gov1",nocase; classtype:attempted-recon; sid:200007265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/main-pages",nocase; classtype:attempted-recon; sid:200007266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/mps-banca",nocase; classtype:attempted-recon; sid:200007267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/mr-pin",nocase; classtype:attempted-recon; sid:200007268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id2",nocase; classtype:attempted-recon; sid:200007269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id3",nocase; classtype:attempted-recon; sid:200007270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id4",nocase; classtype:attempted-recon; sid:200007271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/page-infromation",nocase; classtype:attempted-recon; sid:200007272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/pandemicreliefpackage",nocase; classtype:attempted-recon; sid:200007273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/portale-mps-attivazione",nocase; classtype:attempted-recon; sid:200007274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/savecash-precadastro",nocase; classtype:attempted-recon; sid:200007275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/temp-disable",nocase; classtype:attempted-recon; sid:200007276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifikasiakunfacebookanda2021",nocase; classtype:attempted-recon; sid:200007277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifikasipemblokiran_id",nocase; classtype:attempted-recon; sid:200007278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2ne0epo",nocase; classtype:attempted-recon; sid:200007279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2p3bbbs",nocase; classtype:attempted-recon; sid:200007280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2sfygwy",nocase; classtype:attempted-recon; sid:200007281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/369t78f",nocase; classtype:attempted-recon; sid:200007282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3aolo2y",nocase; classtype:attempted-recon; sid:200007283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3bqoevf",nocase; classtype:attempted-recon; sid:200007284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3g1epw3",nocase; classtype:attempted-recon; sid:200007285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3jrtmmu",nocase; classtype:attempted-recon; sid:200007286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3kdi2ts",nocase; classtype:attempted-recon; sid:200007287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3koilft",nocase; classtype:attempted-recon; sid:200007288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3prjhpk",nocase; classtype:attempted-recon; sid:200007289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3vufm8l",nocase; classtype:attempted-recon; sid:200007290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3xmjxs4",nocase; classtype:attempted-recon; sid:200007291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/a/warning?hash=2wpkhku&amp\;url=http%3a%2f%2fon.liberacaodoapp.co%2f",nocase; classtype:attempted-recon; sid:200007292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/a/warning?hash=3a7rdwh&amp\;url=http%3a%2f%2fon.cef-asseletronica.com%2f",nocase; classtype:attempted-recon; sid:200007293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/taxirsxcy",nocase; classtype:attempted-recon; sid:200007294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blackbearcccouk-my.sharepoint.com",nocase; http_uri; content:"/personal/accounts_blackbearcc_co_uk/_layouts/15/onedrive.aspx?id=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments%2fngb%20urgente%20substanti%c3%able%20update%20%5f%20voorstel%2epdf&amp\;parent=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments&amp\;originalpath=ahr0chm6ly9ibgfja2jlyxjjy2nvdwstbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvywnjb3vudhnfymxhy2tizwfyy2nfy29fdwsvrve5as01b19mukjbcutzeunhv3eznw9ccfbtmze3b2fsrnrgnhpzuenbvlfiqt9ydgltzt1tqjzyquroodjvzw",nocase; classtype:attempted-recon; sid:200007295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bn-acct.com",nocase; http_uri; content:"/restore",nocase; classtype:attempted-recon; sid:200007296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bn-acct.com",nocase; http_uri; content:"/restore/",nocase; classtype:attempted-recon; sid:200007297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodegalatinacorp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/012dsd_fiestamart_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t3v5ldmmhrtlw5cyiohlp9z4yo7ufnrop9j1plyfdkm%3d&docid=1_1d89d259f7e704301aca26ac4dbabaa8d&wdformid=%7bfeb771e5%2d93ee%2d4015%2d8e87%2dd1c30d0f406a%7d&action=formsubmit&cid=f609fe16-56c4-4e2b-a964-75e250d31c99",nocase; classtype:attempted-recon; sid:200007298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodyfitreboot.com",nocase; http_uri; content:"/spider",nocase; classtype:attempted-recon; sid:200007299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodyfitreboot.com",nocase; http_uri; content:"/spider/",nocase; classtype:attempted-recon; sid:200007300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bofa.com-onlinebanking.com",nocase; http_uri; content:"/xvezwsfzwwkhhm3b6zezgdfzeahvksep0ulvwu1nvvldosfpvv20xc1phzdnkruzuzfrstfnxwxdhme01vm5gt1n6zexlwfzvuvc5b1kzsjnrv0ywvm10sljuqjrzetk2vfvwrlvtafpovkeyujaxwgjuqmhnrtvzvdfkyvpsrljzbtb3tlv4yvjvsm9wwepzyznvefmymhdubuphyudob1pwbhlkm0jpverkevdytlbiamhcvdbjmvlxehlxazqxzws5su1uzg1rblpavkhsdvf5ohdua1pytjnvcmfwvmpvwfpgufmwdfzwvjvusfzoym0xu1rsum9arxblvku1cmjxc3jkeja5ls1iodg4n2zmyjnmymfhntzlymi4ntqymjy4yjdlyzjjyjc1owmwy2yx",nocase; classtype:attempted-recon; sid:200007301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bom.to",nocase; http_uri; content:"/nlozan9lgoapq",nocase; classtype:attempted-recon; sid:200007302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bombogadget.com",nocase; http_uri; content:"/public/-/areaclient/",nocase; classtype:attempted-recon; sid:200007303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bonomequedoencasa.blogspot.com",nocase; http_uri; content:"/?aplicar",nocase; classtype:attempted-recon; sid:200007304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/r_bouman_bravobeveiliging_nl/eiafjbddqltcmdxxrdbajdsbhfr37kusmucacmgoxitraa?e=drnrdm",nocase; classtype:attempted-recon; sid:200007305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/personal/r_bouman_bravobeveiliging_nl/_layouts/15/doc.aspx?sourcedoc={b08d0520-a8dd-42bb-9835-d7443040243b}&amp\;action=default&amp\;slrid=1bef3f9f-6078-2000-b22e-969d6b1087ac&amp\;originalpath=ahr0chm6ly9icmf2b2jldmvpbglnaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3jfym91bwfux2jyyxzvymv2zwlsawdpbmdfbmwvrwlbrmpirgrxthrdburywfjeqkfkrhncagzsmzdlvxnnvunhy01nt3hjvfjhqt9ydgltzt02wvjzd2hitdewzw&amp\;cid=fa76d1ab-0178-4af6-9277-2f7cec72f87f",nocase; classtype:attempted-recon; sid:200007306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/personal/r_bouman_bravobeveiliging_nl/_layouts/15/doc.aspx?sourcedoc={b08d0520-a8dd-42bb-9835-d7443040243b}&amp\;action=default&amp\;slrid=8cda429f-002e-2000-286c-d631557a1a52&amp\;originalpath=ahr0chm6ly9icmf2b2jldmvpbglnaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3jfym91bwfux2jyyxzvymv2zwlsawdpbmdfbmwvrwlbrmpirgrxthrdburywfjeqkfkrhncagzsmzdlvxnnvunhy01nt3hjvfjhqt9ydgltzt0tckpwa0rmuzewzw&amp\;cid=23ce5c18-dd3c-4739-8673-ca39efd1bbee",nocase; classtype:attempted-recon; sid:200007307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bre.is",nocase; http_uri; content:"/2r9pyocy",nocase; classtype:attempted-recon; sid:200007308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridgewaterma-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkhunt_bridgewaterma_org/_layouts/15/wopiframe.aspx?guestaccesstoken=qhrrwxcv%2fa2j8c%2fukg2hcmebzjijcu25gjll3su0xl0%3d&amp\;docid=1_16e44d08a60144801bbfe65418a14c35f&amp\;wdformid=%7b40dfd724%2db9a0%2d4f06%2d934b%2d85e6c322e875%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridgewaterma-my.sharepoint.com",nocase; http_uri; content:"/personal/mkhunt_bridgewaterma_org/_layouts/15/wopiframe.aspx?guestaccesstoken=/xnniui8cbcaalna0dt7bvzueqrakfgntkhwho5/z2k=&amp\;docid=1_16402b4f119204432b5a25eea9ef2a029&amp\;wdformid={154f97ef-3518-47f6-97a6-e96e783894e8}&amp\;action=formsubmit&amp\;cid=7e4a2819-73c1-4fca-9921-c9b62a19bd37",nocase; classtype:attempted-recon; sid:200007310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brisbane-architect.com",nocase; http_uri; content:"/wp-admin/user/m&amp\;t-bank-rd333/",nocase; classtype:attempted-recon; sid:200007311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/q72e",nocase; classtype:attempted-recon; sid:200007312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/qiq3",nocase; classtype:attempted-recon; sid:200007313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capacitaciongratisbo.com",nocase; http_uri; content:"/css/iouytreyu/09876543456789pdfacrobat6657898/iuytrjhfghj/llin/lin",nocase; classtype:attempted-recon; sid:200007314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carnegieproperty-my.sharepoint.com",nocase; http_uri; content:"/personal/helen_carnegieproperty_com/_layouts/15/wopiframe.aspx?guestaccesstoken=i93ri6e azsglandv8xwijahnamcfopa87otqqw4lly=&amp\;docid=1_18f09536ac24d4b6c9bd785b3d27746bc&amp\;wdformid={59ac2fc4-0767-42b6-a127-cc529a92b57e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carnegieproperty-my.sharepoint.com",nocase; http_uri; content:"/personal/helen_carnegieproperty_com/_layouts/15/wopiframe.aspx?guestaccesstoken=i93ri6e+azsglandv8xwijahnamcfopa87otqqw4lly=&amp\;docid=1_18f09536ac24d4b6c9bd785b3d27746bc&amp\;wdformid={59ac2fc4-0767-42b6-a127-cc529a92b57e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casteels-my.sharepoint.com",nocase; http_uri; content:"/personal/c_flemal_casteels_fr/_layouts/15/doc.aspx?sourcedoc=%7bac01bb45-c705-4f5f-8e7b-f57fd9daf685%7d&amp\;action=default&amp\;slrid=5693e09f-10cf-c000-546d-77ec6ca5a846&amp\;originalpath=ahr0chm6ly9jyxn0zwvscy1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9jx2zszw1hbf9jyxn0zwvsc19mci9fa1c3qwf3rngxovbqbnyxzjluytlvvuiyakvlb0xnwgdyvudizvpqshvgvevrp3j0aw1lputpuup0mgrumlvn&amp\;cid=5a243ddd-6725-481f-a04f-2a70203b7ad9",nocase; classtype:attempted-recon; sid:200007317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castillohousing-my.sharepoint.com",nocase; http_uri; content:"/personal/acastillo_castillohousing_com/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200007318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cayecaulkercasita.com",nocase; http_uri; content:"/krsettlindad/home.php",nocase; classtype:attempted-recon; sid:200007319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbic.org.br",nocase; http_uri; content:"/wp-content/uploads/wpallimport/logs/7bbea5ce9b2c639903ba92174b2eb446/sfr/2.html",nocase; classtype:attempted-recon; sid:200007320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=1and1%20webmail&d=4934591237720511&mkt=fr-fr&setlang=en-us&w=zwlbvlrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200007321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=1and1+webmail&d=4934591237720511&mkt=fr-fr&setlang=en-us&w=zwlbvlrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200007322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=https://navidmedshop.com/shop/page/1/?per_page=9&d=4934591237720511&mkt=en-us&setlang=en-us&w=cgljurrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200007323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.shopify.com",nocase; http_uri; content:"/s/files/1/0533/5367/6992/t/3/assets/home.html",nocase; classtype:attempted-recon; sid:200007324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centerstlending-my.sharepoint.com",nocase; http_uri; content:"/personal/rnewcomer_centerstreetlending_com/_layouts/15/wopiframe.aspx?guestaccesstoken=j%2f9wodhj7u8077urui6lxbx%2b9vwlzr11ry0pztfyrwq%3d&docid=1_1fabe326fc77a4441995d0cc407c8c49c&wdformid=%7b56d05c68%2d7055%2d4573%2db79b%2df286b64f5853%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centromedicoviladomat.com",nocase; http_uri; content:"/index.php?option=com_content&view=article&id=67",nocase; classtype:attempted-recon; sid:200007326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaisalert.com",nocase; http_uri; content:"/basic.php?k=4fa9db0267dbfa61c8978ff8809f6b071f02c997&amp\;viewed=1",nocase; classtype:attempted-recon; sid:200007327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chronopostvalidation.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post_12.html",nocase; classtype:attempted-recon; sid:200007328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci3.googleusercontent.com",nocase; http_uri; content:"/proxy/rdh-rjsrv9zzrx57iscgov74o1gka4qjdfj01qr7v8-pkjgyvn50tivt7pzqgm5kuqdmonqle3f8eq_t8f4xl6jdozabmf2lxy-888ai8hdji633rg",nocase; classtype:attempted-recon; sid:200007329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci4.googleusercontent.com",nocase; http_uri; content:"/proxy/djc3ckf7jcnj8l0duyaqyjwffeskzbccy9spjiauj_jwrplgw0ahyaf1xozvm6n_fjn8q1-2vkhqqujjr1en3qej703lyxxujt6tto-ttwsl6hgsggp3ehcc",nocase; classtype:attempted-recon; sid:200007330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci4.googleusercontent.com",nocase; http_uri; content:"/proxy/zjba9cvtmkfnoveyofx6gqong0kqi3s69d9o2y32fmu_gankb59tj-rb79bolx0bwbsemnonfhh2esy9olfdp-20gybztkzstfhfheqrrjuefxwiwkqws29wxm6tdobikwz-qkzfphpaldfr",nocase; classtype:attempted-recon; sid:200007331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cimslp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/eric_cimsltd_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wnhqsp58ikn1qzzozpe2oiw%2fmizdr53wegdbyscml7y%3d&amp\;docid=1_1207bcf2f71094b5cb97dcb5bea3e1a3a&amp\;wdformid=%7bd98de46a%2d2777%2d417f%2dbbcf%2d5f08c8244727%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cingular-oac.qpass.com",nocase; http_uri; content:"/oac/html/signin.do",nocase; classtype:attempted-recon; sid:200007333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cityschools2013-my.sharepoint.com",nocase; http_uri; content:"/personal/mkphenicie_bcps_k12_md_us/_layouts/15/wopiframe.aspx?guestaccesstoken=8mqz0pbaequkjg%2bwcpnqtgwrswdh4azr%2bsinor8cw8m%3d&docid=1_1058175d7d73f4b39bb114b0dd340d168&wdformid=%7b1fd2a3e2%2d7ce8%2d4700%2db944%2d171b6be0cea6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cjs254nco9.5406.gencmert.com",nocase; http_uri; content:"/.cjs254nco9.ahr0chm6ly9hc3nlbnn1c29uzs5jb20vl0nquzi1ne5jtzkvotmxmjq3ntgwl3jvymvydc8jcm9izxj0qglpzs5vcmc=",nocase; classtype:attempted-recon; sid:200007335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clck.ru",nocase; http_uri; content:"/yc8bd&post=665308711_37&cc_key",nocase; classtype:attempted-recon; sid:200007336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.email.office.com",nocase; http_uri; content:"/?qs=9cf30363dd29315c3e11be7b9f86e0023a565c20a2375038e17cde83e3918d351e9c862894eecd698e1a9bb86157937bcf1b994ad1bf797a",nocase; classtype:attempted-recon; sid:200007337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.icptrack.com",nocase; http_uri; content:"/icp/relay.php?r=57372110&amp\;msgid=807563&amp\;act=af7a&amp\;c=1365247&amp\;destination=https://www.linkedin.com/&amp\;cf=17638&amp\;v=6023ca6bc5e4f8b8568ed04ff6a646a7d7757336e750d772ecc1cb2b3b6063b4",nocase; classtype:attempted-recon; sid:200007338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.mail.onedrive.com",nocase; http_uri; content:"/?qs=db04a8b2d7b04d1f6b3c69c4c5805dfc93097e61c800b87bab9654d4ce1ee7f86c05b36196ea1c673c13d490edbadd368c6e8f39eb68b3bb",nocase; classtype:attempted-recon; sid:200007339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.message.fruit.com",nocase; http_uri; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280",nocase; classtype:attempted-recon; sid:200007340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.promote.weebly.com",nocase; http_uri; content:"/ls/click?upn=3g-2boalxhqfd9acjc8rrrq2jlh6rgeuxwss-2fw0mkyvdkedasfpapk6r0eu9qosj5dqxo-2ffqmvckqnfqezhcwmbrwfjbud54fzjoqkt2pc56cw2fsctiw05n-2bmavqaphmma15i_i-2bxluspfrnjydjcne-2bgvz5fubrzozhohuynwixc51d0vqx9bnegrlzmzec8xiyizaij9uwzyipcj4tvmmuvceuovhieydgzug-2faycfmuten8q2ve-2fxxhi7lsyycrzptvtf-2bflqssh1z5wvcayupdrij0knzjcvq0-2b0gsk4r-2fsixauaoasbwca7njlfsfaareskt-2flycrvse5hp5eryt9jgldbxjl0ais-2bmnymqfyxdots7jp4yuhsfh6xjhbmlzdrocekgrjdeaywfvigsyjbqfy023-2fxt3br9pzrmwkoanrpnunf97vteczlsnodmyc3q2yfbh29v9ukvc5owz8ktx49xwflv-2bslrskfu3x8gzib8qoler2sjcvbej5vxmskx7zyt2rmyz81igu-2fkjze-2fq9wzpj-2fga-2fxzw5sqtzbgl-2fqw0s4pbzmnddffnx4svkoa4tnyjnda4suaodgxxbnqropimad6ohemanxy9eovs-3d",nocase; classtype:attempted-recon; sid:200007341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clickent.co.jp",nocase; http_uri; content:"/owa",nocase; classtype:attempted-recon; sid:200007342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clickent.co.jp",nocase; http_uri; content:"/owa/",nocase; classtype:attempted-recon; sid:200007343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudflare-ipfs.com",nocase; http_uri; content:"/ipfs/qmdjapbwfsgua9vknmbswgfga4y5kj2vnnphvcsc8nc7ia/",nocase; classtype:attempted-recon; sid:200007344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnam.md",nocase; http_uri; content:"/object/html_elements/laxx/en.php",nocase; classtype:attempted-recon; sid:200007345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coastwholesaleappliances-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/mfiorini_coastappliances_com/ekgio42ixgvmrgruj7hsx1sbuji-eqg6t2m9bxmcb9latw?e=4smg",nocase; classtype:attempted-recon; sid:200007346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coda.io",nocase; http_uri; content:"/d/microsoft-office365_duu9pzwq-rk",nocase; classtype:attempted-recon; sid:200007347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codepasta.app",nocase; http_uri; content:"/paste/c4tl1sfout2tbkhn5810/raw",nocase; classtype:attempted-recon; sid:200007348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cognitoforms.com",nocase; http_uri; content:"/governmentpandemicbonus/form3",nocase; classtype:attempted-recon; sid:200007349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"collinsflg-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/kristin_collinsfamilylaw_com/euf0wztyhj9kqzxuzlzixyabi4yll8ikkpy9hzw5mqnk3w?e=l7oitq",nocase; classtype:attempted-recon; sid:200007350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-f",nocase; classtype:attempted-recon; sid:200007351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-fca9-46c9-b4f6-6c3148ca22a4",nocase; classtype:attempted-recon; sid:200007352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-f",nocase; classtype:attempted-recon; sid:200007353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-fca9-46c9-b4f6-6c3148ca22a4",nocase; classtype:attempted-recon; sid:200007354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communicourt-my.sharepoint.com",nocase; http_uri; content:"/personal/nicky_tolley_communicourt_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=eamfa28gqrgeiwgts4k6r4jeaw5r3nlvgmrujrqweeg%3d&docid=1_102ac4f4a82ef483da9397726d75865ca&wdformid=%7b6fc04434%2d1bec%2d4c45%2dbfde%2d62f16b91c9eb%7d&action=formsubmit&cid=5964b08a-e45b-4bd6-a4e5-d13338c37e65",nocase; classtype:attempted-recon; sid:200007355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.shrm.org",nocase; http_uri; content:"/network/members/profile?userkey=379fbe57-ed85-4d31-8527-ff29bee6fddb",nocase; classtype:attempted-recon; sid:200007356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confabint.com",nocase; http_uri; content:"/discounts_services/writing/loginform2d0e.php",nocase; classtype:attempted-recon; sid:200007357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmnew-payment.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200007358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=354917e2-ac99-45e1-96f9-8be4d200b522&cm_type=link&cm_link=e2ca05a6-2e96-43d5-b07a-cf1ef5e79b36&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200007359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=4e1943c3-7a68-47fb-93f5-16d2565a1cce&cm_type=link&cm_link=a4377bcd-c14a-4ace-8c62-a66fecd57e71&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200007360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=d5721ad4-aabf-4e4e-9a14-1b8e7738fbcf&cm_type=link&cm_link=f89aca33-6081-418d-89e6-c9efd6aa36cd&cm_destination=https://www.designbold.com/design/view/80zebbkpa2/presentation",nocase; classtype:attempted-recon; sid:200007361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coremgt.com.py",nocase; http_uri; content:"/wp-admin/comx1",nocase; classtype:attempted-recon; sid:200007362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coremgt.com.py",nocase; http_uri; content:"/wp-admin/comx1/",nocase; classtype:attempted-recon; sid:200007363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cornersmascout.com",nocase; http_uri; content:"/smartlistings/docusign/index.html",nocase; classtype:attempted-recon; sid:200007364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/0c73cb6bb0934b51f739feda58c2b51c",nocase; classtype:attempted-recon; sid:200007365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/0c73cb6bb0934b51f739feda58c2b51c/",nocase; classtype:attempted-recon; sid:200007366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/1f31134de7de69c358acafbab9d960b8/",nocase; classtype:attempted-recon; sid:200007367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/42f0e3ab6b1cd578b718caf85d8acd49/",nocase; classtype:attempted-recon; sid:200007368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/4cd091f8178a31a79cdce827f9e9ecf8",nocase; classtype:attempted-recon; sid:200007369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/4cd091f8178a31a79cdce827f9e9ecf8/",nocase; classtype:attempted-recon; sid:200007370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/506ae050d1524cb76a9092f6de2e994e/",nocase; classtype:attempted-recon; sid:200007371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/54e0e4ca9c54fbc059916225d81436b6",nocase; classtype:attempted-recon; sid:200007372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/54e0e4ca9c54fbc059916225d81436b6/",nocase; classtype:attempted-recon; sid:200007373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/5a4ae10e1eedfc9e81b230a68d4e967a/",nocase; classtype:attempted-recon; sid:200007374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/8367a5cdc4acacd5b8c361ed681e240d/",nocase; classtype:attempted-recon; sid:200007375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/8e72587626a2f9d8d9bc21500a79d220/",nocase; classtype:attempted-recon; sid:200007376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/93d5a7f143a2c9d132469a1b6e919465/",nocase; classtype:attempted-recon; sid:200007377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/b0672d5500f23ef53ea463ffc772b5f8/",nocase; classtype:attempted-recon; sid:200007378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/b5e433eb04a42bc8c7d3c372604f6eed/",nocase; classtype:attempted-recon; sid:200007379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/bdc743c513ed042babed07ab2c444657/",nocase; classtype:attempted-recon; sid:200007380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/c3291ed569e9062dcf91485e4a638a6f/",nocase; classtype:attempted-recon; sid:200007381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/dabb61a30f07223962ea78df05bf9845/",nocase; classtype:attempted-recon; sid:200007382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; http_uri; content:"/dirkt.raif/ff685e08e2fc14a77bd2072475728c82/",nocase; classtype:attempted-recon; sid:200007383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"couchpop.com",nocase; http_uri; content:"/film/descendants/",nocase; classtype:attempted-recon; sid:200007384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid19.pesakit.co.ke",nocase; http_uri; content:"/marketl/ndex.htm?fjcapwf",nocase; classtype:attempted-recon; sid:200007385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-admin/includes",nocase; classtype:attempted-recon; sid:200007386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-includes/js/crop/cm",nocase; classtype:attempted-recon; sid:200007387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-includes/js/crop/cm/",nocase; classtype:attempted-recon; sid:200007388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php",nocase; classtype:attempted-recon; sid:200007389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200007390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200007391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200007392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp",nocase; classtype:attempted-recon; sid:200007393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515",nocase; classtype:attempted-recon; sid:200007394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200007395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13inboxlight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=jackdavis@eureliosollutions.com&.rand=13inboxlight.aspx?n=1774256418&fid=4",nocase; classtype:attempted-recon; sid:200007396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com",nocase; classtype:attempted-recon; sid:200007397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativeingredient.com",nocase; http_uri; content:"/wp-includes/images/verify/update/y.html",nocase; classtype:attempted-recon; sid:200007398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.com",nocase; http_uri; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html",nocase; classtype:attempted-recon; sid:200007399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crewscontrolmd-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/monica_crewscontrol_com/etsaeagbpbjbtwzh2tom1c4b-dgni3j2covr9b9jmky9na?e=7pz8vh",nocase; classtype:attempted-recon; sid:200007400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cteam-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/michael_hammes_cteam_de/emvsa57h96dfn3pdorq6h9qbfjioxaqwsf3sn9gvu8tkzq?e=nvhbcy",nocase; classtype:attempted-recon; sid:200007401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cusstomerservicee.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200007402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/dkvkq49/",nocase; classtype:attempted-recon; sid:200007403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/irhuisk",nocase; classtype:attempted-recon; sid:200007404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/irhuisk/",nocase; classtype:attempted-recon; sid:200007405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/tqvnbfg/",nocase; classtype:attempted-recon; sid:200007406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy.tc",nocase; http_uri; content:"/oglp",nocase; classtype:attempted-recon; sid:200007407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d.pr",nocase; http_uri; content:"/f/j8j50t",nocase; classtype:attempted-recon; sid:200007408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d.pr",nocase; http_uri; content:"/jiiayu?updateverify=",nocase; classtype:attempted-recon; sid:200007409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dailynewsvermont.com",nocase; http_uri; content:"/wp-admin/network/www.t-online.de.html",nocase; classtype:attempted-recon; sid:200007410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declined-myaccount.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200007411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designbold.com",nocase; http_uri; content:"/design/view/ppzpgr8q91/presentation",nocase; classtype:attempted-recon; sid:200007412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dichvuvnpt.com",nocase; http_uri; content:"/home/components/com_user/bbtonline.html",nocase; classtype:attempted-recon; sid:200007413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fedd.huntershub.online%2fedd%2520prepaid%2fprepaid%2f&amp\;key=tqpetxlm09wtvlwulwkm1g",nocase; classtype:attempted-recon; sid:200007414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fv32vi.org%2fobj%2fx86%2fdebug%2fdebug.html&key=p5-unr13ef1nvpweoa4g6q",nocase; classtype:attempted-recon; sid:200007415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fwww.rmiembassyus.org%2fmedia%2fjui%2fjs%2f&key=i5eldkzvfyplzuuvh2xytg",nocase; classtype:attempted-recon; sid:200007416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fne7tticangmii3&amp\;key=0beekpsfvusz9qc-9u-zwq",nocase; classtype:attempted-recon; sid:200007417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fvpz1ac&amp\;key=yc94ig4npafy0sthcgmlig",nocase; classtype:attempted-recon; sid:200007418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fcompte-suspendu483.tk%2fcaptcha%2f&key=uouejqmfvkrmu_mnfmlqeg",nocase; classtype:attempted-recon; sid:200007419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.adelaidetowingandcarremoval.com.au%2fwp-content%2f%2fuploads%2f2020%2fsocialsecurity%2f&amp\;key=yxyb8swn1zzjw8bcatgrjw######",nocase; classtype:attempted-recon; sid:200007420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.gepard.ru%2flogin%2faccount%2f&key=jgdq7zs0ratd6src39cdig",nocase; classtype:attempted-recon; sid:200007421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distechforum.com",nocase; http_uri; content:"/chase/web",nocase; classtype:attempted-recon; sid:200007422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distechforum.com",nocase; http_uri; content:"/chase/web/",nocase; classtype:attempted-recon; sid:200007423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbburgschaft.com",nocase; http_uri; content:"/323/a47888eef3f23ffbae97a5556b93f952/de/identification/?cgi=031320190&token=03bc7a8e648698a3444fcabe3695942f",nocase; classtype:attempted-recon; sid:200007424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbburgschaft.com",nocase; http_uri; content:"/350/93aae59a285b60f91b00fb4ca670faaa/de/identification/?cgi=031320190&token=6ceb5e03a6fbfa7fda51823143d1a106",nocase; classtype:attempted-recon; sid:200007425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbburgschaft.com",nocase; http_uri; content:"/720/a5221104317fd04e9a47ed7e3d315f4b/de/identification/?cgi=031320190&token=db211f49ece79049779ce336dde4f219",nocase; classtype:attempted-recon; sid:200007426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc",nocase; classtype:attempted-recon; sid:200007427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc/",nocase; classtype:attempted-recon; sid:200007428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vqg5zz0tcdbhy7wfp_7qji6toegexolsgvf_176vf5srqdch5yoc7vqg92mmiz7yvesvbgmzvlagowo/pub",nocase; classtype:attempted-recon; sid:200007429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrsdmi8kqzhphmq1wq1it08vreztms3u-vsojet5ppl9zuo4ismcqxn4fwtissr-h0txmmzaohvs7ty/pub",nocase; classtype:attempted-recon; sid:200007430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrww694tkdqcdswba6r6qvkl2j8ggccuxtq-1x4ocowjttilaenattbakijulc7qev-4hqllutzogev/pub",nocase; classtype:attempted-recon; sid:200007431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrxv6bkbixggv2c_lzouzl6z9ovzqqswl5otameibkkds0jrgilyjy4cpv1lflvobrdumunkipgx6du/pub?embedded=true",nocase; classtype:attempted-recon; sid:200007432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vs36y8r0dzpmbkk0kzlhwl7qp56-1x6jrq34lzp4a2cukpsl9y0gfpcpmx8sjlwiw2db5lysyzisg8o/pub",nocase; classtype:attempted-recon; sid:200007433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub",nocase; classtype:attempted-recon; sid:200007434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin",nocase; classtype:attempted-recon; sid:200007435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true",nocase; classtype:attempted-recon; sid:200007436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vtj_-ldjfuxvxsbw2yivttmklhhwb0xalrxb_sxzub7mvm23nxxvor35_ppdltnvlm7bo8pc5oao0jn/pub",nocase; classtype:attempted-recon; sid:200007437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vts9czxqycsgi-quifs7m1mqjzmlcjlccnhw3dsahdss5ymnpy6y0vsgwvf3piu6js22ydjyew1oyo_/pub?embedded=true",nocase; classtype:attempted-recon; sid:200007438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/u/6/d/e/2pacx-1vs1dvkfrujajsa7oo5lrr8jtgkptt5bkchxfesyemxh3tajbdgtb25uikmsqpb0kahma4jpgkbvhuw7/pub?embedded=true",nocase; classtype:attempted-recon; sid:200007439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/12467akksjbdxtns1aefg-fo9hlxamtxynf5brvbz5tc/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200007440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/17rbx8y2bk8n4tzm0fbld5vi4ldsc0skyuqq0ocijhsu/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200007441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/1fpyjsolbptidxpf23lqom1jghfw7qrvbbbfxxi82pzg/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200007442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform",nocase; classtype:attempted-recon; sid:200007443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc8uc5aztlek3s6dqtk1etorhez5m2yvubyw5qmfkpisrelcq/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200007444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform",nocase; classtype:attempted-recon; sid:200007446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsca1yg551kdvimwhccriwj2kttyqqfalnuaaxacbsdmdwgmwa/viewform",nocase; classtype:attempted-recon; sid:200007447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscc2f9wy8412ndwgxfiimtt08nlzg30g-yt_vx0eooa18ixzw/viewform",nocase; classtype:attempted-recon; sid:200007449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscc30j0zmjvz0ct-wi59yhnz9gimpj3snofe5vkbovmeykomg/viewform",nocase; classtype:attempted-recon; sid:200007450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform",nocase; classtype:attempted-recon; sid:200007451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsccuyl2grf9npasldwjqristlat7up58ttx6syqn-wiun-z1a/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200007452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform",nocase; classtype:attempted-recon; sid:200007453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform",nocase; classtype:attempted-recon; sid:200007454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform",nocase; classtype:attempted-recon; sid:200007456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdkcb2saiqfhtrh2inewegl56-jrv0e_ncfubvdmdprxpzfq/viewform",nocase; classtype:attempted-recon; sid:200007458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdkcb2saiqfhtrh2inewegl56-jrv0e_ncfubvdmdprxpzfq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform",nocase; classtype:attempted-recon; sid:200007461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform",nocase; classtype:attempted-recon; sid:200007462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsch8_wrvwsg5klxptwjznnmghz9ny516msszkmzzjr6wqll4q/viewform",nocase; classtype:attempted-recon; sid:200007463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsci5h_ujssebdglamow3s6enf94ermr6qqcjcvbmzu8_tolcw/viewform",nocase; classtype:attempted-recon; sid:200007464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook",nocase; classtype:attempted-recon; sid:200007465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsco0gvjsnu6vwouw1cnby9hqmoveqoekq63vj95s1xq5gc01g/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscphvypdecdasu-iqnvt4bvkiu5g1fioskjyfi9gk2z69cemq/viewform",nocase; classtype:attempted-recon; sid:200007467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscpmo15entmhowuewraavlp5__blfwvzycg-tikirkugfkeuw/viewform",nocase; classtype:attempted-recon; sid:200007468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscq8lwf5u5pxklisswjs79fcko1u76xaqw2cplb00uamj2epa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform",nocase; classtype:attempted-recon; sid:200007470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscsp2ltu8y_5h-m0512ckji9i1rwabxoforr5hgbkwi-gx9mg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsct1pxn0qq6ulzzs2kqgekpwoa-galaegxg5mzuxii-fvmwaq/viewform",nocase; classtype:attempted-recon; sid:200007472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform",nocase; classtype:attempted-recon; sid:200007473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscvp9muuu33wgba4h5kugaleeh0onrqzug-b6n5aj5werrmaw/viewform",nocase; classtype:attempted-recon; sid:200007474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscvqmhqgwbubzxdynzgvlbmmziyagdiadz2eyhc-s-ro8ndfq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd1x00gqusaavdvp5ualsrctsjb80y9oy7yln6wwani40srpw/viewform",nocase; classtype:attempted-recon; sid:200007477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd1x00gqusaavdvp5ualsrctsjb80y9oy7yln6wwani40srpw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd6h5k1kajgpan-tfvs7w4k_b4wq3m6wjdfh_kfrpiq-3w-ag/viewform?fbzx=8876075289152692257",nocase; classtype:attempted-recon; sid:200007480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628",nocase; classtype:attempted-recon; sid:200007481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd7shjgl-xzh0b--otxbgyaq02wjun61jituz_kgjvmoqhwrg/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd8_xzmknrntxwpeg8bvmvbbzmjsfgejo-vngsmyjx1dnidsg/viewform",nocase; classtype:attempted-recon; sid:200007483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform",nocase; classtype:attempted-recon; sid:200007485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform",nocase; classtype:attempted-recon; sid:200007486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform",nocase; classtype:attempted-recon; sid:200007488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200007489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform",nocase; classtype:attempted-recon; sid:200007491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhdloijpfz-djbc5k5nzwa_mbdym5kgjm1ssgrhwex3sj49g/viewform",nocase; classtype:attempted-recon; sid:200007493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhr2qehprrqzfimbwtlojynm_nvvsdovser7pmho5v5o4cxw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhyezpletqihy8incmgssiwqjlbqwo03ulvjxipjmjjrrscg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdinjm_qvdbv3roybqi073rm1pujmrrs7lid7c3qk-4xwweew/viewform",nocase; classtype:attempted-recon; sid:200007496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdlwgxgjcqz_53lnvyfaiibnkptndldhs4vd0c__6lufv81zq/viewform",nocase; classtype:attempted-recon; sid:200007497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform",nocase; classtype:attempted-recon; sid:200007498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdnngh7an2vfxw1k7cotxcb24wwne2qcm3j5deelwsn676z2q/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200007500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdp-5roof4dzzivh9nvegldbqvrbi60inudyjxdj7qoevj9qw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdp6gmot9lhhgyqmwp6tavohtvtacptly7nzcuiynoir9cjbg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdpyvreq-ep0jbvs8gp2oehnu3bxiac9fskhtmy4gmyvq5ihw/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200007503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdpyvreq-ep0jbvs8gp2oehnu3bxiac9fskhtmy4gmyvq5ihw/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvo-nueiprck-o5gw7-bnmsz9jvwlyspeqfhfr2g2osbsrba/viewform",nocase; classtype:attempted-recon; sid:200007505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform",nocase; classtype:attempted-recon; sid:200007507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdxkjopelrwprbruv5pypgeut5c971mdpwp9w1ndxosaui0oa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform",nocase; classtype:attempted-recon; sid:200007510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzpz7mn6te18_1olbnvu14ez5j_lscj_pintnwldwht6wtaq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform",nocase; classtype:attempted-recon; sid:200007512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform",nocase; classtype:attempted-recon; sid:200007513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse659tcdnppv704bqfgkhuwvmmlufcbpaicqx075d_gxnsqba/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform",nocase; classtype:attempted-recon; sid:200007516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseaoj1gseoc72inocx9jofb1nqgqm81_firdsookdvnd4fz3q/viewform",nocase; classtype:attempted-recon; sid:200007517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform",nocase; classtype:attempted-recon; sid:200007518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseck8-g3um70ihw-ajfait5whcec3qdowobizswz8_-et_jkq/viewform",nocase; classtype:attempted-recon; sid:200007520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseerl98zqhhsjdo_vwhfzft3njmrw-es6isa689uqc2opalkg/viewform",nocase; classtype:attempted-recon; sid:200007521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsefdjhvlb8j4f16k5uewfckrm6sxun7mb8kmt6hnsw4twzb1a/viewform",nocase; classtype:attempted-recon; sid:200007522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsefv5nkokmsxbkw84jsid2gwxxq8hhcvvajj-hjwl43irewza/viewform?vc=0&amp\;c=0&amp\;w=1",nocase; classtype:attempted-recon; sid:200007523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseggxi9u9oxdijtvvfpdkom7-bau-dstzgnovfyndrhxtk_ew/viewform?fbzx=450838898210045776",nocase; classtype:attempted-recon; sid:200007524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform",nocase; classtype:attempted-recon; sid:200007526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseja63wnjv6158neslzqwlnlui4yluhb0nlou-vx0ehpwkexg/viewform",nocase; classtype:attempted-recon; sid:200007527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform",nocase; classtype:attempted-recon; sid:200007528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejg2xiowc36xpgb4yrzafossvuajgg7b3kyoyr91ahcajyhg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejg2xiowc36xpgb4yrzafossvuajgg7b3kyoyr91ahcajyhg/viewform?usp=sf_link%3e",nocase; classtype:attempted-recon; sid:200007530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsek2havgkyh0nefyqqhxvt5lu7hmj-weg4s9s_j07dnon30iw/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsel_ki8gcgzajteddl27pbkpo6w90de6hj6epzsurphsvekpg/viewform?embedded=true",nocase; classtype:attempted-recon; sid:200007532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemuphd9zpegybxx9gwrw-vsu9gbqjuufhz2wx34p7cj1cibq/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform",nocase; classtype:attempted-recon; sid:200007535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200007536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform",nocase; classtype:attempted-recon; sid:200007537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform",nocase; classtype:attempted-recon; sid:200007538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsesuqyiwovf64ujl8ewzqpw-vq7_ljhh96vouros2rqn1vunw/viewform",nocase; classtype:attempted-recon; sid:200007539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform",nocase; classtype:attempted-recon; sid:200007540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform",nocase; classtype:attempted-recon; sid:200007542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform",nocase; classtype:attempted-recon; sid:200007543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewymtg0_yxlw9-prz205ldklpt1q0_aklvlput4ndg_coetq/viewform",nocase; classtype:attempted-recon; sid:200007545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsexrthgahyza746esrgvtj4hqnjlqgmef_k2l3usnolt1fjgg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseyedrifg-qlmvdq0o9il9kmr_p85q1giqync2uwgbbi5he1q/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform",nocase; classtype:attempted-recon; sid:200007548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf43dgkrjoe0kbhyqzxvaswkmbstzlu6x-40xi-sxxgfevhww/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf6z9onabfo6e0tdct4ajfm2jgmyyju_msfaofou8dca04yfa/viewform",nocase; classtype:attempted-recon; sid:200007550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf9wlt_kxvre3b2hhpi0hcx4zia83c9bbkabo4w15nfekvwuw/viewform",nocase; classtype:attempted-recon; sid:200007551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform",nocase; classtype:attempted-recon; sid:200007552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfaexmgpgntdkiayu-wg3vbkhus9frurejyqxukiiydkjc3ug/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfah-zi4rxn7shcplz8xqlwm9idkwfmvqxl_br62sduy9hyda/closedform",nocase; classtype:attempted-recon; sid:200007555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfanborkr2ivrhpsjdnvnb-jktwkjbuub3wnsxb-md7haddsq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfcadutx0elsh0wfimgfoedkee1p3gr2wf_qnv_ctizw8ztaa/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200007557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfcbbgof7lfcganiwuiubcqdhwl_ppaaxbwiuf7aqmljimizq/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200007558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsffxdjsibp7kmfd28idwdkvupj3klesiwvpoiecz8xpgdh0cq/viewform",nocase; classtype:attempted-recon; sid:200007560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfgomlcpbyhodks1bwjmx6f5jr0tqwhngun_juf2qk0jp8dbq/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfgrkvxsp4vv3h2jpge8n2rwi_acvt3o91y4av8-nbjpc0xxw/viewform?c=0&amp\;w=1",nocase; classtype:attempted-recon; sid:200007562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfh-impaknvwlynkq8u0tetf0nw-b_3iepqmfkruaso7fb4kq/viewform",nocase; classtype:attempted-recon; sid:200007563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfhzli805cycnlai887dfo6ra8bwbwjbc8uehmv5amiaqdbyq/viewform",nocase; classtype:attempted-recon; sid:200007564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform",nocase; classtype:attempted-recon; sid:200007565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform",nocase; classtype:attempted-recon; sid:200007566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9fn6xlhju27dzlzxp6nzvjlaqbtzb3uf20uakw6ddguvnw/viewform",nocase; classtype:attempted-recon; sid:200007568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9fn6xlhju27dzlzxp6nzvjlaqbtzb3uf20uakw6ddguvnw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform",nocase; classtype:attempted-recon; sid:200007570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfksirdejkit-tdeiwrnkf00ygsqdsqth0hmwydiqdik10tna/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform",nocase; classtype:attempted-recon; sid:200007572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsforgq2zksc0soenei1m7xcow9surjrynoh6ppsku6_kxvdpw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform",nocase; classtype:attempted-recon; sid:200007575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfpvmlfha5uwdz_4bnvq19l2mctpltose6aszym6w9ls0hxza/viewform",nocase; classtype:attempted-recon; sid:200007577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization",nocase; classtype:attempted-recon; sid:200007578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsr_hufaploql8ruxbcya-5su5xpkzee0qtzs6_ixatjrmcw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200007581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvhavjlgw4__-x0qdg5tbot5uo9vkn4csn8mx3lpvkdah8ag/viewform",nocase; classtype:attempted-recon; sid:200007584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvvvnddwmy-3u-agx0bvar5wfmplx8bvgef_zdia7ra9llfg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200007585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwbcfrxuktidm2ctjalngebxbx4k_dijxbekg2y-naausaqw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200007586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform",nocase; classtype:attempted-recon; sid:200007587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfxoc8vekgqzkhzna2nynvv4fpmbntvo6_rbnwinjte4at6ya/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200007588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfygwrauuzg0kcnd6w_s42qneyhqpha0zs1rift0akntmlugq/viewform",nocase; classtype:attempted-recon; sid:200007589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfyxrzgheo7is9dyegsl1h9_4t7mcqz9msa0ttzh0sby6bmow/viewform",nocase; classtype:attempted-recon; sid:200007590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vqhu5f9qjt9duj5oq2is4bqxokuq2ebewhyxc9wz2mcdnhpiz8zkw8vcz6horujg2hbe8yrcjeump4e/pub?start=false&loop=false&delayms=3000",nocase; classtype:attempted-recon; sid:200007591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vrn2g1dgcoqbd_vlv01bwwwim-oqfddsmoyj7ias_0bnqd6kes65sy45dil8kk96x5tmjt6sllf0qhe/pub?start=false&loop=false&delayms=3000",nocase; classtype:attempted-recon; sid:200007592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p",nocase; classtype:attempted-recon; sid:200007593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/viewerng/viewer?url=proxy.ge.tt/1/files/5d0k9lx2/0/blob?referrer%3duser-a6kjrvmdexz9favkffsdh44k4iybrxak3pn41u-%26pdf&amp\;ddrp=1=secured",nocase; classtype:attempted-recon; sid:200007594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/viewerng/viewer?url=proxy.ge.tt/1/files/8tnpiby2/0/blob?referrer%3duser-ur6z6ngiuctfxjqxnhc2bxyonvsmvcncqdrvc-%26pdf",nocase; classtype:attempted-recon; sid:200007595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dolcevitabymerit.com",nocase; http_uri; content:"/exchange328e91ec88ae4615bbc38ab6ce41104e/jspuser328e91ec88ae4615bbc38ab6ce41107e/?08a3ea=brian_casey@capgroup.com",nocase; classtype:attempted-recon; sid:200007596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollar-cheetah.net",nocase; http_uri; content:"/unclaimed-stimulus-landing.html?trkid=1&cka=227&cko=411&cks1=1732&cks2=102bcecb275559165c1d419b3d913b&cks3=209738",nocase; classtype:attempted-recon; sid:200007597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollarfreedom.co",nocase; http_uri; content:"/mk8uj06hqettfpix7cjp6_zr0ko2bvcfdtsruj4mvf_s_a0",nocase; classtype:attempted-recon; sid:200007598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollarfreedom.co",nocase; http_uri; content:"/pybxlfgla_42oeuwv0rb6t_2xbgmyzwlqhpxnke8klsu__q",nocase; classtype:attempted-recon; sid:200007599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doveadolescentservices-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/g/personal/alice_dovecare_co_uk/eux9kze32kbkhhfsn9xq0neblkljq83z_9o1u8jpewiq2a?e=4%3ah1ax4s&amp\;at=9",nocase; classtype:attempted-recon; sid:200007600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/19tpqpl-rcxwj-fqpk9yfzch19qtdx50y/view",nocase; classtype:attempted-recon; sid:200007601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit",nocase; classtype:attempted-recon; sid:200007602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200007603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe",nocase; classtype:attempted-recon; sid:200007604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cc4iizuwctob05muvpmydl-rruxdfimu/edit",nocase; classtype:attempted-recon; sid:200007605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cppgzjnodnftsks_w82um_b_ctgzn-ah/edit",nocase; classtype:attempted-recon; sid:200007606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cvc0ts0fkrsyx6vnnuypmotnh7jkcsln/edit",nocase; classtype:attempted-recon; sid:200007607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200007608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fsvmjkcq7ennrsfdufkcxshfhnda_fui/view",nocase; classtype:attempted-recon; sid:200007609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui",nocase; classtype:attempted-recon; sid:200007610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view",nocase; classtype:attempted-recon; sid:200007611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ik3uxh3rdigwar7d269wvkowp17cci1n/edit",nocase; classtype:attempted-recon; sid:200007612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view",nocase; classtype:attempted-recon; sid:200007613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jvfh6wq9ea9kxr1shhwbh3pecflqzppc/edit",nocase; classtype:attempted-recon; sid:200007614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1knolz4xw7mgncsjysbomy_y4zxlk6zld/view?usp=sharing",nocase; classtype:attempted-recon; sid:200007615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1mg5asnyoeet7qsg2n0d_2paxc3j7wx3k/edit",nocase; classtype:attempted-recon; sid:200007616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view",nocase; classtype:attempted-recon; sid:200007617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit",nocase; classtype:attempted-recon; sid:200007618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ttaa6m96xsz9kxqa0zy3mzoirfmbspkd/view?usp=sharing",nocase; classtype:attempted-recon; sid:200007619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1xpjy2kxsljvynrhgntllyzgvlzfxmvuc/view?usp=sharing",nocase; classtype:attempted-recon; sid:200007620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1zmjm3f6e-mgx8ev829md4mxxyd300nbb",nocase; classtype:attempted-recon; sid:200007621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dumerobui.xyz",nocase; http_uri; content:"/geo/dk/eur/register/5/index.php",nocase; classtype:attempted-recon; sid:200007622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dumerobui.xyz",nocase; http_uri; content:"/geo/ie/eur/register/5/index.php",nocase; classtype:attempted-recon; sid:200007623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dumerobui.xyz",nocase; http_uri; content:"/geo/no/eur/register/5/index.php",nocase; classtype:attempted-recon; sid:200007624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dumerobui.xyz",nocase; http_uri; content:"/geo/se/eur/register/5/index.php",nocase; classtype:attempted-recon; sid:200007625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebayfraud.gremlins-in-it.com",nocase; http_uri; content:"/fraudulent.html",nocase; classtype:attempted-recon; sid:200007626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; http_uri; content:"/wp-content/plugins/alldomain/domain/dmain/index.php?i=i&amp\;0=abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200007627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecusltd-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/angela_ure_ecusltd_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=umwosbguhwaqic3hhtqfly7zjwf8oggrcn6d%2bggohoc%3d&docid=1_1956f6e254d71417a89981b2a1c8d0a99&wdformid=%7be61ca4f5-c461-425a-a52e-4598e7b699e5%7d&action=formsubmit&cid=4ab9a2a7-7cf4-43ae-8149-ffead8d66e7b",nocase; classtype:attempted-recon; sid:200007628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eeverywhere-my.sharepoint.com",nocase; http_uri; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn",nocase; classtype:attempted-recon; sid:200007629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elgozon8589.eshost.com.ar",nocase; http_uri; content:"/iniciar%20sesi%c3%b3n.html",nocase; classtype:attempted-recon; sid:200007630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmeform.com",nocase; http_uri; content:"/builder/form/f9u1s4b5dfa5rfvgpn2fe25y/",nocase; classtype:attempted-recon; sid:200007631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmeform.com",nocase; http_uri; content:"/builder/form/rn6bf7v0znavp58",nocase; classtype:attempted-recon; sid:200007632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"encrypted-tbn0.gstatic.com",nocase; http_uri; content:"/images?q=tbn:and9gctpssw1eco05z7yyt9h5de gpvythapzl23nhw&amp\;usqp=cau",nocase; classtype:attempted-recon; sid:200007633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9 sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eswissch.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200007637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eternityflooringcom-my.sharepoint.com",nocase; http_uri; content:"/personal/selena_eternityflooring_com/_layouts/15/doc.aspx?sourcedoc={29a0efff-8f51-40d9-bcd9-4bcf8ae74f33}&amp\;action=default&amp\;slrid=6b27489f-b027-a000-cb27-3003139f9096&amp\;originalpath=ahr0chm6ly9ldgvybml0ewzsb29yaw5ny29tlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3nlbgvuyv9ldgvybml0ewzsb29yaw5nx2nvbs9fdl92b0nsumo5bef2tmxmejryblr6tujpogm4v1nqd3pvbetjlw41q3u3ukrbp3j0aw1lpv91atzqq2pmmtbn&amp\;cid=1ad0104b-547c-477b-be5a-854c21f3580b",nocase; classtype:attempted-recon; sid:200007638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eternityflooringcom-my.sharepoint.com",nocase; http_uri; content:"/personal/selena_eternityflooring_com/_layouts/15/doc.aspx?sourcedoc={29a0efff-8f51-40d9-bcd9-4bcf8ae74f33}&amp\;action=default&amp\;slrid=9e004d9f-c028-a000-7c23-0d326de333e6&amp\;originalpath=ahr0chm6ly9ldgvybml0ewzsb29yaw5ny29tlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3nlbgvuyv9ldgvybml0ewzsb29yaw5nx2nvbs9fdl92b0nsumo5bef2tmxmejryblr6tujpogm4v1nqd3pvbetjlw41q3u3ukrbp3j0aw1lpxozoufndjdxmtbn&amp\;cid=502ded77-e010-4694-a1c8-3e651bc6ea9e",nocase; classtype:attempted-recon; sid:200007639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eurobankovnikredit.com",nocase; http_uri; content:"/?fbclid=iwar3cu_8pblosqw-rwa7evcrs5jpl6zvzkou0qrf7vl9oqge4h2ctmcxrdyk",nocase; classtype:attempted-recon; sid:200007640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventsinamerica.com",nocase; http_uri; content:"/eia-mobile/app/tracking-die/inbox/account/ifram/index.php",nocase; classtype:attempted-recon; sid:200007641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/client/snv?noteguid=777735b6-7206-0be1-628f-b095ff26a485&amp\;notekey=803670c5e267fe76b14b5c7466cb9dd8&amp\;sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs321%2fsh%2f777735b6-7206-0be1-628f-b095ff26a485%2f803670c5e267fe76b14b5c7466cb9dd8&amp\;title=you%2bhave%2ba%2bfax%2521%2bcopy%2bcopy",nocase; classtype:attempted-recon; sid:200007642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/client/snv?noteguid=777735b6-7206-0be1-628f-b095ff26a485&notekey=803670c5e267fe76b14b5c7466cb9dd8&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs321%2fsh%2f777735b6-7206-0be1-628f-b095ff26a485%2f803670c5e267fe76b14b5c7466cb9dd8&title=you%2bhave%2ba%2bfax%2521%2bcopy%2bcopy",nocase; classtype:attempted-recon; sid:200007643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/sh/9b9c2e56-0df3-1e03-5a66-617cf5ca0041/1153b91b874b7a19b82fe1a3955ecad2",nocase; classtype:attempted-recon; sid:200007644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail",nocase; classtype:attempted-recon; sid:200007645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&notekey=02a9fa6bd051dc6b4581ee3b617b3f88&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs339%2fsh%2ff48e12fd-48da-e57f-8e76-cdf6e4054e1d%2f02a9fa6bd051dc6b4581ee3b617b3f88&title=optus%2bwebmail",nocase; classtype:attempted-recon; sid:200007646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88",nocase; classtype:attempted-recon; sid:200007647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s349/client/snv?noteguid=febdfb3a-d3dc-4087-8cc9-5f87708ee16b&notekey=8ca96608bc2196024b9081f6dcfcfb14&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs349%2fsh%2ffebdfb3a-d3dc-4087-8cc9-5f87708ee16b%2f8ca96608bc2196024b9081f6dcfcfb14&title=new%2bfax%2bmessage%2breceived%2bcopy",nocase; classtype:attempted-recon; sid:200007648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s417/client/snv?noteguid=df310074-30f9-9003-58c2-15885df371d2&notekey=3f0a7060a363b0def315a6d1c98f0a9c&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs417%2fsh%2fdf310074-30f9-9003-58c2-15885df371d2%2f3f0a7060a363b0def315a6d1c98f0a9c&title=payment%2badvice%252fremittance",nocase; classtype:attempted-recon; sid:200007649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s430/client/snv?noteguid=1e315989-372f-4f18-9094-04b8976afbff&amp\;notekey=9f2538feedc6675daabd34267b45ad36&amp\;sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs430%2fsh%2f1e315989-372f-4f18-9094-04b8976afbff%2f9f2538feedc6675daabd34267b45ad36&amp\;title=secured%2bmicrosoft%2bazure%2bfor%2bone%2bdrive%2bcloud%2bcopy",nocase; classtype:attempted-recon; sid:200007650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s430/client/snv?noteguid=1e315989-372f-4f18-9094-04b8976afbff&notekey=9f2538feedc6675daabd34267b45ad36&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs430%2fsh%2f1e315989-372f-4f18-9094-04b8976afbff%2f9f2538feedc6675daabd34267b45ad36&title=secured%2bmicrosoft%2bazure%2bfor%2bone%2bdrive%2bcloud%2bcopy",nocase; classtype:attempted-recon; sid:200007651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=483c5f32-f1b7-7c70-925c-47f2705bab52&notekey=911c810bd15ccbd1f19fba1c3e4cc4d5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f483c5f32-f1b7-7c70-925c-47f2705bab52%2f911c810bd15ccbd1f19fba1c3e4cc4d5&title=you%2bhave%2breceived%2ban%2binvoice",nocase; classtype:attempted-recon; sid:200007652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice.",nocase; classtype:attempted-recon; sid:200007653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/483c5f32-f1b7-7c70-925c-47f2705bab52/911c810bd15ccbd1f19fba1c3e4cc4d5",nocase; classtype:attempted-recon; sid:200007654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5",nocase; classtype:attempted-recon; sid:200007655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s661/client/snv?noteguid=bb8d3313-c8e9-0ead-34c7-0a149c4fd42d&notekey=f25f8be6665ac7e37aff532080567fab&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs661%2fsh%2fbb8d3313-c8e9-0ead-34c7-0a149c4fd42d%2ff25f8be6665ac7e37aff532080567fab&title=you%2bhave%2breceived%2ba%2bsecure%2bdocument%2bvia%2bonedrive.",nocase; classtype:attempted-recon; sid:200007656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s672/client/snv?noteguid=b30b4b36-5bf9-846c-0577-bbb0c4439efc&notekey=2f0f6f89194031fabbc3b4a455071a64&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs672%2fsh%2fb30b4b36-5bf9-846c-0577-bbb0c4439efc%2f2f0f6f89194031fabbc3b4a455071a64&title=microsoft%2boffice365",nocase; classtype:attempted-recon; sid:200007657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s740/client/snv?noteguid=6dd4c982-2f3f-7d83-4e18-5e028127e7d1&notekey=399d3f6c5e422fb90527fefea85cfc44&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs740%2fsh%2f6dd4c982-2f3f-7d83-4e18-5e028127e7d1%2f399d3f6c5e422fb90527fefea85cfc44&title=initial%2bpage",nocase; classtype:attempted-recon; sid:200007658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everythingmobilelimited-my.sharepoint.com",nocase; http_uri; content:"/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/_layouts/15/onedrive.aspx",nocase; classtype:attempted-recon; sid:200007659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everythingmobilelimited-my.sharepoint.com",nocase; http_uri; content:"/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/_layouts/15/onedrive.aspx?id=/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/documents/new%20project.pdf&amp\;parent=/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/documents&amp\;originalpath=ahr0chm6ly9ldmvyexroaw5nbw9iawxlbgltaxrlzc1tes5zagfyzxbvaw50lmnvbs86yjovzy9wzxjzb25hbc9qyw1lc3dhdgvyc3rvbl9ldmvyexroaw5nbw9iawxlbgltaxrlzf9vbm1py3jvc29mdf9jb20vrvdlwwrbqvrqvzlqz0nvvjhmlwvavdrcc3lhv3rndhpvvfbla01pdfdkqnnzut9ydgltzt1ouuvztxjrudjvzw",nocase; classtype:attempted-recon; sid:200007660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excelelectrical0-my.sharepoint.com",nocase; http_uri; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn",nocase; classtype:attempted-recon; sid:200007661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"explorebathurst.com.au",nocase; http_uri; content:"/rrefeeieoj.html?erectrcsq@*cthiytvcdx$zsxycuikjmkjivee$terdtygjyvtrre",nocase; classtype:attempted-recon; sid:200007662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"falconproducts.com",nocase; http_uri; content:"/well-known/pki_validations/log-in",nocase; classtype:attempted-recon; sid:200007663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"falconproducts.com",nocase; http_uri; content:"/well-known/pki_validations/log-in/",nocase; classtype:attempted-recon; sid:200007664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php",nocase; classtype:attempted-recon; sid:200007665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php...",nocase; classtype:attempted-recon; sid:200007666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/lnqsfxqwsed/~3/yywjpi-42i4/analog.php",nocase; classtype:attempted-recon; sid:200007667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/muejft/~3/ycyn6gnet0k/warehousing.php",nocase; classtype:attempted-recon; sid:200007668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/spqgxlzjlss/~3/byf895vf6tk/nutrition.php",nocase; classtype:attempted-recon; sid:200007669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feeds.feedblitz.com",nocase; http_uri; content:"/~/t/0/_/jensbookpage/~https%3a%2f%2fqf3nt.codesandbox.io/",nocase; classtype:attempted-recon; sid:200007670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feeds.feedburner.com",nocase; http_uri; content:"/investorway",nocase; classtype:attempted-recon; sid:200007671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200007672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finanzkontoterminaltest.com",nocase; http_uri; content:"/t6jttwnfpx",nocase; classtype:attempted-recon; sid:200007673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/achproject509353-i353-3ih5f-10.appspot.com/o/achbf-vye-ur-g8%252fbv-ebry-8g%252fbf-vye-ur-g8%252fbv-ebry-8g%25%40fabf-vye-ur-g8%252fbv-ebry-8g10.html?alt=media&amp\;token=cf886132-ee55-43e8-9d0f-a6dbb7ba590a#",nocase; classtype:attempted-recon; sid:200007674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/armaoffices.appspot.com/o/fdsklxrsqgdkqrwszsprjmbwtftqgpthwjwqjvvzscstgnmcvbblfcbcgwzjjbt.htm?alt=media&token=e3feec53-9d57-4eff-9b7a-d58e91e54d4c#user@domain.com",nocase; classtype:attempted-recon; sid:200007675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/aws1900384756tapscodec4749.appspot.com/o/aws1900384756tapscodec4749%2faws1900384756tapscodec47%2faws1900384756tapscodec47%2faws1900384756tapscodec47%2faws1900384756tapscodec47%2faws1900384756tapscodec47%2faws1900384756tapscodec47%2fboxmoni.html?alt=media&amp\;token=22692277-9eff-4a86-9af9-6c953d18a0b9#user@cslanet.calstatela.edu",nocase; classtype:attempted-recon; sid:200007676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bet2604ver.appspot.com/o/bet2604ver%2findex2bat904rff27dcf22a2ea9163406004.html?alt=media&token=e70fe211-f84a-4ae7-a4d0-c9376ee4cf57#",nocase; classtype:attempted-recon; sid:200007677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/biyugbhiuhgy7o900-h9oh98h9-987.appspot.com/o/vnmbvuyt8-8y98yh0%3d890y8iuh9yyh%2f5rtyfghtfyu67-9876trfc%3d9ygv.htm?alt=media&amp\;token=dce6f041-19ff-4e8a-8012-1cfdac4cf369#bv@pplsi.com",nocase; classtype:attempted-recon; sid:200007678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bmvfhjewter358bsvgtst.appspot.com/o/!%40%25%24%23ohow2%26%25%26%24%23!%23%24!.html?alt=media&amp\;token=a7216a8f-9691-45b2-9775-693dd99503e8#randyharp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bnnnnnn-2133f.appspot.com/o/sboy.htm?alt=media&token=4b58a3ec-3a18-4152-a41f-55a89a34d017&login",nocase; classtype:attempted-recon; sid:200007680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bus0607clougensatem.appspot.com/o/bus0607clougen%2findex2bus0607447d066cb774.html?alt=media&amp\;token=5baac3e2-5da8-4153-86b4-8971a2ac5892#banko@10acrewood.com",nocase; classtype:attempted-recon; sid:200007681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/car2-2004crgpng.appspot.com/o/index2ibicar.html?alt=media&amp\;token=9c9647f6-f132-4e13-8ad4-c44765b9133e#abuse@google.com",nocase; classtype:attempted-recon; sid:200007682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#reima.helminen@utu.fi",nocase; classtype:attempted-recon; sid:200007683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#service.itz@zhdk.ch",nocase; classtype:attempted-recon; sid:200007684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dam3005genwtbgfam.appspot.com/o/reddam0806%2flag0806famegen-040447d066cb774f1.html?alt=media&amp\;token=f1dd8ee6-33f2-4149-93f7-3db577373528#dickfleming@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dfhdskfkgkrgr8zrhrthrdrdh.appspot.com/o/!%23%24%26%25%24%23bn3%23%24!%26%25%24.html?alt=media&amp\;token=311bb9c7-ae6f-40e9-96e3-a06e7bccfa0e#viestinta@utu.fi",nocase; classtype:attempted-recon; sid:200007686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr",nocase; classtype:attempted-recon; sid:200007687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com",nocase; classtype:attempted-recon; sid:200007688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ee-orex-eire-581.appspot.com/o/webmail-welcome-to-webmail.html?alt=media&amp\;token=6fa19c2c-b2cd-478d-bbf0-6092db00e352#@yorku.ca",nocase; classtype:attempted-recon; sid:200007689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/goo2-ac630.appspot.com/o/goo (2).html?alt=media&amp\;token=2d1281a2-3364-420f-a3b5-c693b7bda1f2#a@b.com",nocase; classtype:attempted-recon; sid:200007690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/gredor-intlwebpoint.appspot.com/o/incexiui8uh.html?alt=media&amp\;token=d7e2191e-cde5-4233-a67b-14f3d7d58f56#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200007691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/gsdffdwatdfwdadddadsgd.appspot.com/o/!%23%24%40%26buli%24!%40%26!%40%23%24!%26.html?alt=media&amp\;token=110228a1-3566-41ef-b241-427ad3b25a9f#aaronfredricks@legalshield.com",nocase; classtype:attempted-recon; sid:200007692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hing9-f9bc0.appspot.com/o/hi1 (9).html?alt=media&amp\;token=0d56c7d7-2e03-41f5-b764-4473f0ad4d51#a@b.com",nocase; classtype:attempted-recon; sid:200007693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hutobonmu7g.appspot.com/o/butokilopo.html?alt=media&token=6b98d9bd-5513-45d3-ab8a-e46571a70ee4#user@example.org",nocase; classtype:attempted-recon; sid:200007694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932",nocase; classtype:attempted-recon; sid:200007695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932#raymondtripp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/macryti-109.appspot.com/o/kp-oe0%2fbtt-hash.html?alt=media&amp\;token=02abe8bd-5141-4b5a-a7d4-08120e5f43dd#choiteng@motenghaiplc.com",nocase; classtype:attempted-recon; sid:200007697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mail9-e6376.appspot.com/o/index.html?alt=media&amp\;token=f619a1f5-b1a4-4b63-9d00-6df1874c4b1b#memberservices@legalshield.com",nocase; classtype:attempted-recon; sid:200007698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&amp\;token=420caa32-915f-40c5-86a6-28ada5625a7a&amp\;prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200007699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&token=420caa32-915f-40c5-86a6-28ada5625a7a&prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200007700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mic-apps03629.appspot.com/o/index.html?alt=media&token=d9f4f11c-e123-4b2b-8cba-b4f3f3541786#peterawl@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mon-office.appspot.com/o/mscsq1-t-check-packet.htm?alt=media&token=72ab1aeb-a7a9-4a84-9852-099a56ca500e#dxnlckblegftcgxllm9yzw",nocase; classtype:attempted-recon; sid:200007702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ntachi-e1dbe.appspot.com/o/hgigieiciejceinhviejrie95489349%20(19).html?alt=media&amp\;token=5901e369-e71e-416b-9688-b21c62e31587#m.couvee@colasit.nl",nocase; classtype:attempted-recon; sid:200007703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/on1rt-44071.appspot.com/o/index.html?alt=media&token=0d469e93-836b-4af8-b206-16a5d882d556#abuse@fasthosts.com",nocase; classtype:attempted-recon; sid:200007704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200007705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200007706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#fgsnews@yorku.ca",nocase; classtype:attempted-recon; sid:200007707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.de",nocase; classtype:attempted-recon; sid:200007708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.test",nocase; classtype:attempted-recon; sid:200007709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#vid@yorku.ca",nocase; classtype:attempted-recon; sid:200007710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200007711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#landman56@att.net",nocase; classtype:attempted-recon; sid:200007712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#sdeco@prodigy.net",nocase; classtype:attempted-recon; sid:200007713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/tb%2findex.htm?alt=media&amp\;token=8176e96d-c102-4018-9888-17d4dec8d489#",nocase; classtype:attempted-recon; sid:200007714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/web123%2findex.htm?alt=media&amp\;token=442069a5-b026-42a7-bcea-e6d92963d1d3",nocase; classtype:attempted-recon; sid:200007715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#bb@bb.com.br",nocase; classtype:attempted-recon; sid:200007716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#eafaef@eafaef.com.br",nocase; classtype:attempted-recon; sid:200007717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#fdsfsdfsd@fdsfsdfsd.com.br",nocase; classtype:attempted-recon; sid:200007718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200007719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt",nocase; classtype:attempted-recon; sid:200007720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/q797k09738937033.appspot.com/o/kb9468478928903284782.html?alt=media&amp\;token=a19b3d7c-3450-40a6-81df-d5149266a912#fssf@fssf.com.br",nocase; classtype:attempted-recon; sid:200007721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/qrwetryuiopoiouer.appspot.com/o/golibe%20first%20refud%20.html?alt=media&amp\;token=a8d86c77-73ee-4286-b3f5-70b77fda2646#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200007722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com",nocase; classtype:attempted-recon; sid:200007723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#support@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200007724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200007725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/serveradministratoryikjrpee1.appspot.com/o/second%20(1).html?alt=media&amp\;token=d92aaee3-61c4-4326-9384-d39d22513c26#info@cobos-fs.de",nocase; classtype:attempted-recon; sid:200007726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/solomidey-57f22.appspot.com/o/%ec%8a%b5s832%eb%8b%a4%ed%95%a0j%ec%98%a4%eb%98%90%eb%8b%a4f-1dr2%ec%9d%80bo%2f-%ec%9e%88otr4s%eb%a1%9cuz9-tov%ec%9e%88-73l-os%eb%8b%88os9%ec%98%a4ck-z-rr%2f-5-lc:26ppdz3:a%ed%95%a0nb%ed%95%a08%eb%b0%9bw%ec%82%ac%2f487hhu74y.html?alt=media&amp\;token=2a2c8312-b0dd-4adf-8b8a-d5655ecb2174#",nocase; classtype:attempted-recon; sid:200007727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/start-e65e8.appspot.com/o/index.html?alt=media&amp\;token=238a55a4-cd6d-4df2-8cb8-eca24b670093",nocase; classtype:attempted-recon; sid:200007728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/syundon-45969.appspot.com/o/vutoprwz.html?alt=media&token=d778956b-9882-4818-863e-5e6d5627d4ea",nocase; classtype:attempted-recon; sid:200007729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/trows9098.appspot.com/o/25%255e%2524%2523%2540.html?alt=media&amp\;token=51dbb7d7-54ca-47bb-bbfc-f03691ac3d14&amp\;utm_medium=marketing&amp\;%24web_only=true&amp\;_branch_match_id=716254997194823397#samba@jubileegroup.co.uk",nocase; classtype:attempted-recon; sid:200007731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tu-03yg-3yhg-3yh4g-93h4g-h.appspot.com/o/wrjfgbho3429uy-03294y-gf93hgf-9y%2f30t49u30-tu-3hg3hg-39g-jug.html?alt=media&amp\;token=a35ff937-2752-4bdc-b4fe-da15853821c5#jtucker@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/updatess-9a650.appspot.com/o/index.html?alt=media&amp\;token=7be8eeaf-2217-40c7-9504-4e8118de2618#example@example.com",nocase; classtype:attempted-recon; sid:200007733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/updatess-9a650.appspot.com/o/index.html?alt=media&token=7be8eeaf-2217-40c7-9504-4e8118de2618#example@example.com",nocase; classtype:attempted-recon; sid:200007734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/user3987267105468.appspot.com/o/a1%2findex.htm?alt=media&amp\;token=0ea51307-7b68-4058-abb5-4d7006478527#test@example.com",nocase; classtype:attempted-recon; sid:200007735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wacvuipqa-wavaddiom.appspot.com/o/cvaysfgysy.html?alt=media&amp\;token=faaf3715-8974-4f79-a92e-e788c6d97995#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200007736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wacvuipqa-wavaddiom.appspot.com/o/cvaysfgysy.html?alt=media&token=faaf3715-8974-4f79-a92e-e788c6d97995#email@domain.com",nocase; classtype:attempted-recon; sid:200007737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wdrhghxlcnwtjkjltmrtztqlh.appspot.com/o/celibacy - copy (7).html?alt=media&amp\;token=30c670b1-9299-45c6-a16b-5bd1037c4499#@yorku.ca",nocase; classtype:attempted-recon; sid:200007738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xmailzytrsdemailkipt.appspot.com/o/dom1.html?alt=media&amp\;token=2c0996a9-d916-47f9-9d23-d876408acb88#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200007739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xn-nerio-reioz-481.appspot.com/o/indexxxv%25454%255.html?alt=media&amp\;token=ce2be12b-3c3d-42df-adb4-e246fa16b9c2#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200007740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xsxiz-77918.appspot.com/o/zx8six.html?alt=media&amp\;token=37023509-8607-4487-99de-22f2f5480716#reneesumpter@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ze-nerio-reoz-447.appspot.com/o/indexxxv3534.html?alt=media&amp\;token=147ed254-cb63-40a9-aca6-9e544f1929f1#abuse@uregina.ca",nocase; classtype:attempted-recon; sid:200007742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flavena.co.rs",nocase; http_uri; content:"/mc.html",nocase; classtype:attempted-recon; sid:200007743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/p/cldvsqn6z?fc=0",nocase; classtype:attempted-recon; sid:200007744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/p/dnitl0pla?",nocase; classtype:attempted-recon; sid:200007745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9j2",nocase; classtype:attempted-recon; sid:200007746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9jg",nocase; classtype:attempted-recon; sid:200007747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/5884980",nocase; classtype:attempted-recon; sid:200007748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/6015526/my-form",nocase; classtype:attempted-recon; sid:200007749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/6027380/form",nocase; classtype:attempted-recon; sid:200007750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.asana.com",nocase; http_uri; content:"/?k=cdxmabdeiqp1ls8o45yzlw&amp\;d=1200547430279636",nocase; classtype:attempted-recon; sid:200007751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/19fzdjrlxxquwqpf7",nocase; classtype:attempted-recon; sid:200007752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/1mqqu8exzgpptqpl8",nocase; classtype:attempted-recon; sid:200007753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/3cyoxmwxqkbfpt2v5",nocase; classtype:attempted-recon; sid:200007754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/9bwawhpz5vi7ilpe6",nocase; classtype:attempted-recon; sid:200007755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/akohiguxjs9wlpu28?sllqm",nocase; classtype:attempted-recon; sid:200007756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/b7lqaal42juffiw1a",nocase; classtype:attempted-recon; sid:200007757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/bfz2l7i3wvrp5heb9",nocase; classtype:attempted-recon; sid:200007758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/dncj4btc56n1n71n8",nocase; classtype:attempted-recon; sid:200007759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/edtu6r7rqxqyegcf6",nocase; classtype:attempted-recon; sid:200007760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/egj66jkgwkcd3aat8",nocase; classtype:attempted-recon; sid:200007761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/eozlrnnf7jh84xdp8",nocase; classtype:attempted-recon; sid:200007762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx",nocase; classtype:attempted-recon; sid:200007763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gkszreuf5x38hgfb7",nocase; classtype:attempted-recon; sid:200007764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/goerpntl5tfeumdz6",nocase; classtype:attempted-recon; sid:200007765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gr4b9sxradtcj7or7",nocase; classtype:attempted-recon; sid:200007766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/guptjarp2xatzbvo8",nocase; classtype:attempted-recon; sid:200007767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/iai7pzm4pxyb145i9",nocase; classtype:attempted-recon; sid:200007768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp",nocase; classtype:attempted-recon; sid:200007769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jzxtb9auexgjcewfa",nocase; classtype:attempted-recon; sid:200007770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/kehch96avaku7oey7?akowgmooutpwa",nocase; classtype:attempted-recon; sid:200007771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/nvljeb1quzaovd8u5",nocase; classtype:attempted-recon; sid:200007772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd",nocase; classtype:attempted-recon; sid:200007773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/q8hewogxwmnkcpqh8",nocase; classtype:attempted-recon; sid:200007774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/qrrg7m5mcasfuk6e9",nocase; classtype:attempted-recon; sid:200007775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/qzopkn9aj2gzaw2g6",nocase; classtype:attempted-recon; sid:200007776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/ruaxzqjjzghi8rar9",nocase; classtype:attempted-recon; sid:200007777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/rwpcmhm8vtfa7f4m8",nocase; classtype:attempted-recon; sid:200007778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/sj21ehdebhkcpvfv6",nocase; classtype:attempted-recon; sid:200007779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/smufgmyhduckbq6ka?fjxhgyroek",nocase; classtype:attempted-recon; sid:200007780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/uqzzznxv4cfhu3yr9",nocase; classtype:attempted-recon; sid:200007781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/v5xtnywt5s6zvpp27",nocase; classtype:attempted-recon; sid:200007782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/v7k2chwbcca59vz27",nocase; classtype:attempted-recon; sid:200007783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/w6uh9p66tdq6l1m66",nocase; classtype:attempted-recon; sid:200007784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/wqycsyy8jhuhvaex7",nocase; classtype:attempted-recon; sid:200007785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x3aasffazsrl8pcr9",nocase; classtype:attempted-recon; sid:200007786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x8hybjggubfftabw8",nocase; classtype:attempted-recon; sid:200007787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/xxccjhuzjtg4pr3y8",nocase; classtype:attempted-recon; sid:200007788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/xxjqmu6luzkpnalg6",nocase; classtype:attempted-recon; sid:200007789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/yfxkceytox2zuyvb6",nocase; classtype:attempted-recon; sid:200007790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/formspro/pages/responsepage.aspx?id=t3dj48rwk0sjoalzgnmn6bafynfdky5orhyq9zv62tpuqusztlhxmvviuupxskvlrvmyuldyuko5ny4u&amp\;vt=e36377b7-70c4-4493-a338-095918d327e9_1973aa6c-a10f-46bb-a912-07c43f73112e_hash7_gcdqoyksqmupfbm4pwloqi%2bnuyahsmp%2b8bemc6qhdqu%3d",nocase; classtype:attempted-recon; sid:200007791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=3syn-1cchkavxgboptj0hevjly0merbjkz3gprj_t75un1ltuvezqla2wudrnlltmtbqs0q3mlvfti4u",nocase; classtype:attempted-recon; sid:200007792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=60hhzfbtoe-qdzpnyrluyo-ivxb0mexgqufvg5tcyifunzg5uknzne1irjzvt1y3slewrepwnflmvs4u",nocase; classtype:attempted-recon; sid:200007793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=79zc40bzquqwhsumk8wi7ifmk8wscglbvpsk75lcq2funzlxovuzrfm2vthps0jfuzg1qvrevtkzmc4u",nocase; classtype:attempted-recon; sid:200007794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=9mkl-ub4beksg-bmxxmbpmobeab-n85cvyzfhjasiu5urvdoqja3q1vrqlyyvehtqu9vntfhvelqtc4u",nocase; classtype:attempted-recon; sid:200007795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=bu78ampjjeewrm5mbe2yjju5rluqqzbmpxmzobiguotum05arfrrr1bmmfhnqlvumlphtlfnrlg2mc4u",nocase; classtype:attempted-recon; sid:200007796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhum0rptlhfndbbwfnmu1k2uktsve9jszk0rc4u",nocase; classtype:attempted-recon; sid:200007797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhumus3nklqsuuzoetaofldrdjtvu82muhxms4u",nocase; classtype:attempted-recon; sid:200007798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhunehvsvgywurrwvfxr1qwodliwepdtkpqmi4u",nocase; classtype:attempted-recon; sid:200007799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaa__qth0uruodzxsevzmvldsepnvkjotudjm1e0nk9evy4u",nocase; classtype:attempted-recon; sid:200007800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaa__qtvbajunvzamtfcvlq4q0yxm05pmkvwtllimzdnwc4u",nocase; classtype:attempted-recon; sid:200007801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaabxpdkjumkljwjzsnvpduec1tutmuvpqqtnlufnwuc4u",nocase; classtype:attempted-recon; sid:200007802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtumlpuvfc1veneu0zwvenyu01asljnn0vfqi4u",nocase; classtype:attempted-recon; sid:200007803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtunexjt1hfrfi1nzk0n1lutthsnzvjv0e2uy4u",nocase; classtype:attempted-recon; sid:200007804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtuq00xqlhsr1hiwelun0rwwe0ymtfjmdawns4u",nocase; classtype:attempted-recon; sid:200007805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtuq0fpvfbfrkpnn0kxv08wrtvmoekymenbus4u",nocase; classtype:attempted-recon; sid:200007806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaacuhhh9urjbfulzfvulpnthxnljgquy0tdrpmulfry4u",nocase; classtype:attempted-recon; sid:200007807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaadtgljzurew0nuc4szawvznimehywuu5wvmyvfczri4u",nocase; classtype:attempted-recon; sid:200007808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaanf70j5umkk5t0gwtthlnly2mffpnzdzr0hqt0tlvi4u",nocase; classtype:attempted-recon; sid:200007809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaanf70j5uqtc4sei3tkhyn1hgwlmxslbvnvddqzjptc4u",nocase; classtype:attempted-recon; sid:200007810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__idhxlruofndulbkv1yxuva0mvpbsdjynk02vtq0ws4u",nocase; classtype:attempted-recon; sid:200007811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__idqx2luqkvdqzfcvfpiulhrvzbisfngwefqsznrmc4u",nocase; classtype:attempted-recon; sid:200007812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__iryfuzurvngmfbtvdzfmjfgufhvwkm3rzzar1jvns4u",nocase; classtype:attempted-recon; sid:200007813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__jdhomtumug3tk00ruhdt0vhsudysluwq0rbnencmi4u",nocase; classtype:attempted-recon; sid:200007814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaadkwe9jumllwstgxmtdhvetgnjbqn0dfvlfiuzjsms4u",nocase; classtype:attempted-recon; sid:200007815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaarzinhfurfkytlznnvq2r0fumfhiseptn0i2sjdcsi4u",nocase; classtype:attempted-recon; sid:200007816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaasedm8vum1zrrk9zv1jzsjlvqvrawfgyrtbxvtjboc4u",nocase; classtype:attempted-recon; sid:200007817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaash00u5um0jmrk5fvlzatfphnddjslhct0tqofzdvy4u",nocase; classtype:attempted-recon; sid:200007818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaatnvo6numk8xntbxqk1dodlwu1bbrjjstfvjufjymy4u",nocase; classtype:attempted-recon; sid:200007819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__r4jmpzuqu9qvtnynuq0rfrlvdzznlzxquhpsercmi4u",nocase; classtype:attempted-recon; sid:200007820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__seywchunehdtzm5vjayvjzkmlvrs0vwnvbnujhnmy4u",nocase; classtype:attempted-recon; sid:200007821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sfhld5uqvrirlzgntk0u1zsqzyysfawwvbbvu85ni4u",nocase; classtype:attempted-recon; sid:200007822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sfnbxluqlbctexonfc4oevgnefcufywm1fjtju5ss4u",nocase; classtype:attempted-recon; sid:200007823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__snrwtpuqjvenecwqkzbnfdfr1jku0nkqjlwrzdsrc4u",nocase; classtype:attempted-recon; sid:200007824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__spb8hhurdnondhfouw3ndlavjdyrfddwjlzsedsvs4u",nocase; classtype:attempted-recon; sid:200007825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__srwmhxuretyne5nrjdkq0dasjznujm2mdhmsflkvy4u",nocase; classtype:attempted-recon; sid:200007826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__svkz5xurjnlvug3netwszexnudqovdyuda2tdyxrc4u",nocase; classtype:attempted-recon; sid:200007827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sweyulumuxnwlbytvhlnu5wstyzvkviredwskzcws4u",nocase; classtype:attempted-recon; sid:200007828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u",nocase; classtype:attempted-recon; sid:200007829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u",nocase; classtype:attempted-recon; sid:200007830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tmcie5uode4ourdofzzwepgtkdzmzjlwk40tfbkui4u",nocase; classtype:attempted-recon; sid:200007831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaa0-vkzunzrzmu1zrda1odrftlnlodhguzlssfbhrs4u",nocase; classtype:attempted-recon; sid:200007832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaa2meqpurufbvjc1q1czuke4ulrvr1y2oernqlzkvy4u",nocase; classtype:attempted-recon; sid:200007833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaalzmthuourlq0vqtvfdt0u3wlhfretfvkhir0pvws4u",nocase; classtype:attempted-recon; sid:200007834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaao2yyrurffavkw1u1lwulbawlbqwevzqtjkmulity4u",nocase; classtype:attempted-recon; sid:200007835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaas-la5urvmwqvqyvufjmvbomu5vsvbcudywvezwsi4u",nocase; classtype:attempted-recon; sid:200007836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaaunxyrumtzmrlnnv1hwvfdwr1zinvzutfrtvke0ty4u",nocase; classtype:attempted-recon; sid:200007837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaave1ljumkjardbxn0plmkrbn1nsn1ztuezcvjhros4u",nocase; classtype:attempted-recon; sid:200007838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaavwmwlumdq4m1donkpasdzhwehkvurptzdmndi2vc4u",nocase; classtype:attempted-recon; sid:200007839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaawff7humutduk85ruwzn0hcovk4n0e3nunyovizvy4u",nocase; classtype:attempted-recon; sid:200007840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaawk7snun0qyneuwr0nyntg0r1nwq05cn08wwefery4u",nocase; classtype:attempted-recon; sid:200007841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaaycqtvurjexwuxnsu4znuvctzrywly4qviwt1frsi4u",nocase; classtype:attempted-recon; sid:200007842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__g2q2wzuq1zynjq1wfhjr1y3wtrsszlxwthywljxrs4u",nocase; classtype:attempted-recon; sid:200007843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gs1jibumzjhwkezsdzvwvzendnnwly0r0zkmjrmtc4u",nocase; classtype:attempted-recon; sid:200007844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__guylchunfcxt0prvurnsezcrtm4vdeytklcwuiytc4u",nocase; classtype:attempted-recon; sid:200007845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gy-0ydurtg3mzc4wfixveq3wdnbqvfovdbhvkxmtc4u",nocase; classtype:attempted-recon; sid:200007846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gyeyavunjvrv1nonjvhs0c4qvkwmfa3qlhurk5zsc4u",nocase; classtype:attempted-recon; sid:200007847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gypjlduqvravvlqtepnwlnjn1iytuc0mfixs0tfrc4u",nocase; classtype:attempted-recon; sid:200007848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaadym1fuotfisfdam1fjmk1kqju3rk82uvnhvfptvc4u",nocase; classtype:attempted-recon; sid:200007849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaei3rhuq0fnuu5rmznyuky1t1gxmjfru1uxv1viuy4u",nocase; classtype:attempted-recon; sid:200007850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaets9fun1nfntazovrqn1lbwtdzrzlwqumynze0my4u",nocase; classtype:attempted-recon; sid:200007851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaafdyoxurehctzjdmjfrwjntndjem0xenkntmtdhmy4u",nocase; classtype:attempted-recon; sid:200007852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaflubtumfhem0vlnfjuszu4tktmnk9xovzmqthytc4u",nocase; classtype:attempted-recon; sid:200007853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaiprvrunlrbuewzmvlkqljnrdlqukfsmlu4wevmry4u",nocase; classtype:attempted-recon; sid:200007854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=fz-8elvwiu6kicn2zo2olhg81y6qaolpsppzfph-tm5un0iyr0hnn1vqtezonjewuvhpq0tju0fqsi4u",nocase; classtype:attempted-recon; sid:200007855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ihle7-a1oei7afvzywhaws5xiqgz8mfkm8p-86mqnr9undhln1lqteyzqvc1tlk5mfozwvawtknkmy4u",nocase; classtype:attempted-recon; sid:200007856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u",nocase; classtype:attempted-recon; sid:200007857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=lsipqxnvleck4xxhpkfav5ivtrnxmdhngicoeqskxorunlaws1ngrujswvnvnzfdrfjnvljdtehmwi4u",nocase; classtype:attempted-recon; sid:200007858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ngregipt_k6tg1m4a_cm6emdexhpbtfao3l5c4fjinbunk9qu1uwstjys1jumfnytlfhmllwsjuzvc4u",nocase; classtype:attempted-recon; sid:200007859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=o1kpbby4gegron8dfasq2ijzeu7mzr9pqflgizarhujun0vvvkrumvvxuecyt1hqmuo1ttg3we02tc4u",nocase; classtype:attempted-recon; sid:200007860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=qjetd-pj6eer0hggxsw7en8q0eijx4rkhjeopersgj5unjvevdlktextr0vdujg0mlvqs09uwvq1ui4u",nocase; classtype:attempted-recon; sid:200007861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=tdtustnlhem59-pmb0_bsirohc__jc9lgcdfek0aqshumudjnfiynehuuvnoquuxsthnmehfmvu3vs4u",nocase; classtype:attempted-recon; sid:200007862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ucuxcxtdou2goz1lrb39f18hvs8pokvjkugvzz4uwvxumflbrjaywe1hq0q3tlo3sdjcvjfqmddbrc4u",nocase; classtype:attempted-recon; sid:200007863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=zxaxwd0jf06p5cqmduzpgkuxo26r9wtjo7rvzofgckbuodbeqtlmtlzislpjmui5n01zq1but0ptni4u",nocase; classtype:attempted-recon; sid:200007864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=zzzg0pjjwuckyuiehxswjrab8y4i7hbcnnkwxccpxl5um08xmlzrs05ruerlwuphnknwmlm2ovnwsy4u",nocase; classtype:attempted-recon; sid:200007865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.plumsail.com",nocase; http_uri; content:"/64976d98-2ab0-40a5-ab9c-d7d113806cad",nocase; classtype:attempted-recon; sid:200007866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fotojosue.com",nocase; http_uri; content:"/wp-content/maintenance/wells/wellsfargo/session/signin.php?appidkey=67uvxgqtqwndlrblaczbi1jgy3",nocase; classtype:attempted-recon; sid:200007867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fotojosue.com",nocase; http_uri; content:"/wp-content/maintenance/wells/wellsfargo/session/signin.php?appidkey=hgvtuo9hdnbmpmyscrw3u5y8ga&amp\;country=us&amp\;error=",nocase; classtype:attempted-recon; sid:200007868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fra1.digitaloceanspaces.com",nocase; http_uri; content:"/gmaingt/server.html",nocase; classtype:attempted-recon; sid:200007869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fra1.digitaloceanspaces.com",nocase; http_uri; content:"/newre/server.html",nocase; classtype:attempted-recon; sid:200007870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-counters.co.uk",nocase; http_uri; content:"/cgi-bin/go.pl?go=bfranklin.info?8466714862",nocase; classtype:attempted-recon; sid:200007871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/105f60268899aad/region.php?particulier",nocase; classtype:attempted-recon; sid:200007872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/1c57cc490e9d5e5/region.php?particulier",nocase; classtype:attempted-recon; sid:200007873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/48e3e31d6f469f5/region.php?particulier",nocase; classtype:attempted-recon; sid:200007874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/684ee8f67724e20/region.php?particulier",nocase; classtype:attempted-recon; sid:200007875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/874e7b70f340c1b/region.php?particulier",nocase; classtype:attempted-recon; sid:200007876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/d83e97792d12108/region.php?particulier",nocase; classtype:attempted-recon; sid:200007877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freshskinandbodyfairport.com",nocase; http_uri; content:"/contact/",nocase; classtype:attempted-recon; sid:200007878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/jeff_fsstrading_com/ec1yk-fkwzlkst3oymd07zsbczspqpfzu5xd2yuha-cdkq?e=4:u3zdsc&amp\;",nocase; classtype:attempted-recon; sid:200007879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lptfsymt5qzfymlvn",nocase; classtype:attempted-recon; sid:200007880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpw5vumzpbezxmlvn",nocase; classtype:attempted-recon; sid:200007881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxhhu3nzawszmlvn",nocase; classtype:attempted-recon; sid:200007882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxoyofnswww0mlvn",nocase; classtype:attempted-recon; sid:200007883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxz4zdjpwww0mlvn",nocase; classtype:attempted-recon; sid:200007884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fundrive.proket.co.in",nocase; http_uri; content:"/old/how/chase1.html",nocase; classtype:attempted-recon; sid:200007885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fundrive.proket.co.in",nocase; http_uri; content:"/reloading/okay/ait/att/at&amp\;t%20-%20login.htm",nocase; classtype:attempted-recon; sid:200007886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gajaraet.com",nocase; http_uri; content:"/secured/daum",nocase; classtype:attempted-recon; sid:200007887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gategrouphq-my.sharepoint.com",nocase; http_uri; content:"/personal/blong_gategroup_com/_layouts/15/guestaccess.aspx?guestaccesstoken=jkghay3r4orn8wc0zd79dnyb04dbnmyodqfqq3l16ai%3d&docid=1_1301726a996e54eeeb9bb73b976ebfd9f&wdformid=%7bdb9d2414%2d67ae%2d4062%2d8a45%2dd2b36a1684b6%7dorganization",nocase; classtype:attempted-recon; sid:200007888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gbmfg-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/lbuckner_gbfab_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gdnrnx745yiwuqi1wzlf6w9k%2b6ozugek1niyoatemo4%3d&amp\;docid=1_1a36206e272bc431d8dfc6cbdca53c0b9&amp\;wdformid=%7b68959735%2da202%2d46a8%2dafa8%2d88abc1501bcf%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gencon010-my.sharepoint.com",nocase; http_uri; content:"/personal/rod_genconfoundation_ca/_layouts/15/wopiframe.aspx?guestaccesstoken=qbytax%2bl2vxnykfybitwe9%2fn%2b6efsyak3%2fwkifsixbw%3d&docid=1_133834fad9cd14e23a7158c9b824fb8dd&wdformid=%7b9dcdb876%2df09f%2d406d%2dab2b%2d0136fd43ab4d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfmfxefsrr-my.sharepoint.com",nocase; http_uri; content:"/personal/jose_pozos_ferromex_mx/_layouts/15/doc.aspx?sourcedoc=%7b898ad54d-f65d-469d-9423-f005add906d1%7d&amp\;action=view&amp\;wd=target%28sveriges%20kommuner%20och%20regioner.one%7c824a1570-71a2-449b-8f1b-52edf0fb672c%2fsveriges%20kommuner%20och%20regioner%7c2911b9b7-5576-49e5-9af3-8fb42aa40f70%2f%29",nocase; classtype:attempted-recon; sid:200007891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/caixa-liberar",nocase; classtype:attempted-recon; sid:200007892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/v3ngy",nocase; classtype:attempted-recon; sid:200007893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/vnb37",nocase; classtype:attempted-recon; sid:200007894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/vq7cw",nocase; classtype:attempted-recon; sid:200007895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gizmodo.jp",nocase; http_uri; content:"/2021/07/amazon-wins-approval-to-track-your-sleep-with-iot-devic.html",nocase; classtype:attempted-recon; sid:200007896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glendale0-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/ehill_glendale_edu/edp8lvxgaovdswobx1evwzgbe6bbpjtrc_t5ydrnn6wjha?e=4%3a7rcvxs&amp\;at=9",nocase; classtype:attempted-recon; sid:200007897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/doc.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;slrid=ff713e9f-60ea-a000-8e05-346a19231873&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpuj0m3pvwfrimtbn&amp\;cid=aaec3b1a-484c-4074-a782-e1cd778bff97",nocase; classtype:attempted-recon; sid:200007898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200007899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe2.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200007900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/js/netflix/refund/",nocase; classtype:attempted-recon; sid:200007901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix",nocase; classtype:attempted-recon; sid:200007902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix/store/us-en167/",nocase; classtype:attempted-recon; sid:200007903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix/store/us-en969",nocase; classtype:attempted-recon; sid:200007904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gns.io",nocase; http_uri; content:"/viabcp",nocase; classtype:attempted-recon; sid:200007905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fewn4m6ddswnry2qa24yh81a&amp\;persistence=1&amp\;checksum=938bb495fb191cc8ca89a5c300b60d2b1baafaa75b11e85993f0b9f7cc07a565",nocase; classtype:attempted-recon; sid:200007906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fewn4zq5fegh6bf3qpasy44v&amp\;persistence=1&amp\;checksum=3d7975c121a1d514f1b3a9facb177a78f25e1326da6497ae9cf35e33ba436119",nocase; classtype:attempted-recon; sid:200007907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fewn4zx501vbg1xj6vr2hk10&amp\;persistence=1&amp\;checksum=fc555be29c86e6e13177069b7632770b2cb9f30b36d229624f37be1cb2475704",nocase; classtype:attempted-recon; sid:200007908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fey1pewqgha9bqebgbvwe95n&amp\;persistence=1&amp\;checksum=3fefba73b68799e5152bf7031ce8a7b1a300456243ee123a27f6efca31d9f055",nocase; classtype:attempted-recon; sid:200007909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fez46yyrvh6f0bbehn8h419h&amp\;persistence=1&amp\;checksum=069f46345ac935567ad562a3d64a332066064c97f8feae803d555f9cc820c561",nocase; classtype:attempted-recon; sid:200007910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fezncfbjbj86yneatjn0qvt4&amp\;persistence=1&amp\;checksum=8142350e161acc6cb246be1d05d596973a1d3ac50af1f3594ee9ea462c87a4ef",nocase; classtype:attempted-recon; sid:200007911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff06m6n2q43m6zcaqrh8xpm2&amp\;persistence=1&amp\;checksum=26e140f8abae23dd0c8dd547390a4deb9fc54b1acf3539d8aa44fb19e04902ef",nocase; classtype:attempted-recon; sid:200007912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff0qxy635yfpkrdaxav47j5k&amp\;persistence=1&amp\;checksum=cb2e0f7328d6ffea0e15a24046095a0bb98d27d4488e822bea4b181763f2eb0b",nocase; classtype:attempted-recon; sid:200007913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goarticles.info",nocase; http_uri; content:"//wp-content/themes/sqldmp/?key=degxw,email={email}?key=9tmhz,email={email}&post=00574_1&cc_key",nocase; classtype:attempted-recon; sid:200007914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.gl",nocase; http_uri; content:"/yozuaz",nocase; classtype:attempted-recon; sid:200007915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.su",nocase; http_uri; content:"/page/about",nocase; classtype:attempted-recon; sid:200007916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.su",nocase; http_uri; content:"/page/rules",nocase; classtype:attempted-recon; sid:200007917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com.br",nocase; http_uri; content:"/search?q=suporte+itau",nocase; classtype:attempted-recon; sid:200007918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?hl=en-us&q=http://3214003.remaxcapitals.com/&sa=d&source=meet&ust=1624122560720000&usg=afqjcnhwftmstoowfxkgstiqfgifukkveq",nocase; classtype:attempted-recon; sid:200007919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http%3a%2f%2fbit.do%2ffr6ci&sa=d&sntz=1&usg=afqjcne7joz-iz-adrzkrxcihj8t9fs9qw",nocase; classtype:attempted-recon; sid:200007920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http://srv-auth.web.app/upd/index.html%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1607952068298000&amp\;usg=afqjcnet34jepejaewvja8unv7ycds1vjg",nocase; classtype:attempted-recon; sid:200007921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2fmzecz.webeden.co.uk&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcnh1ztf5yvm-siyhw9c4ndil6ms7qa",nocase; classtype:attempted-recon; sid:200007922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2futcz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngdpz7pfk-brjpkuutxdwb4h3rlsw",nocase; classtype:attempted-recon; sid:200007923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2fwcze.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcneb-aqy-rdcgvkoko781u108eggxw",nocase; classtype:attempted-recon; sid:200007924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://393512dfd8544c98be9a40f2f67df8bd.svc.dynamics.com/t/r/a7uua5shyiplufx4zj7f6u2clgtguiagoxngfoio4am?clientid%3d70000%23%5bemail%5d%2b00-70000&amp\;source=gmail&amp\;ust=1636719774661000&amp\;usg=aovvaw2fsk8htfwhsfqapvbu674n",nocase; classtype:attempted-recon; sid:200007925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://chungcuvinhomessmartcity.com.vn/wp-content/fan/update/update/index.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1601526775264000&amp\;usg=afqjcnh2cow19dlgy8epljp37gqo0awthw",nocase; classtype:attempted-recon; sid:200007926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://duodanseclub.fr//nh/rd/logon/?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1593678623293000&amp\;usg=afqjcnhq3h-kf1tmy7iq1nwza8yz6k4xmq",nocase; classtype:attempted-recon; sid:200007927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://firebasestorage.googleapis.com/v0/b/bmf1406rplpil.appspot.com/o/bmf1406replpil%252findex2bmf0306famegen-040447d066cb774f1.html?alt%3dmedia%26token%3d2205d63d-f15d-4f03-b27a-a81b473b81a4%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1625561695699000&amp\;usg=afqjcnhdvz1aajb9caf_hdl5vkxquj0iog",nocase; classtype:attempted-recon; sid:200007928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://passionfruit4576261.brizy.site/&amp\;source=gmail&amp\;ust=1608664764243000&amp\;usg=afqjcnghljnr1tyn8j4c1ijid09ra9ehdq",nocase; classtype:attempted-recon; sid:200007929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://us4-usndr.com/ru/mail_link_tracker?hash%3d6k5ar5ciusdx1q1tdgm8atcrexmonyy3xdfiogu7zr6gb6gtthpqk7fm8tz4gzkjftg9oouu31eqdro67dtgwnn5x1p3ziiieq8rykja%26url%3dahr0chm6ly90lm1ll2fhegnvbw11bml0eq~~%26uid%3dndmwndy3nw~~%26ucs%3dd93ed45d47070739243d9b678dd03e93&amp\;source=gmail&amp\;ust=1607288611770000&amp\;usg=afqjcngo5kdwx08p-bg6mzdtluzdjhtzxw",nocase; classtype:attempted-recon; sid:200007930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://webstar-connect.weebly.com&amp\;source=gmail&amp\;ust=1620915131083000&amp\;usg=afqjcnfuzfi8hwqislot7koopf3sh9xsdg",nocase; classtype:attempted-recon; sid:200007931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=d&q=https://appengine.google.com/_ah/logout?continue=https://hangouts.google.com/linkredirect?dest=https://schwarz.id.au/recipe//wp-content/--/https:/retail.santander.co.uk/?cliente=ardellasmith@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewiptyxoicttahw1mfwkhaz_cigqfjabegqibbac&url=https://yoga.gift/hello-world/&usg=aovvaw1ac3xuoh8rl8htbwhsbtqy",nocase; classtype:attempted-recon; sid:200007933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewj997bwwr_uahu6bgmbhue6b44qfjaaegqiahac&url=https%3a%2f%2fsitus99dominoqq.com%2f&usg=aovvaw0_cbun7nnl19bpyx5-dyip",nocase; classtype:attempted-recon; sid:200007934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewjvtam1_9dwahxjpj4khyndc-yqfjaaegqibxad&url=https%3a%2f%2fvzk.co.za%2f&usg=aovvaw1jap4fxa7zb0pnmzjp351q",nocase; classtype:attempted-recon; sid:200007935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleads.g.doubleclick.net",nocase; http_uri; content:"/pcs/click?adurl=https://lcdjh.codesandbox.io/#stevewilliamson@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200007936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=5cee2623.shared-excel-f0ssozzz.pages.dev?shared=byrdww1@widomaker.com",nocase; classtype:attempted-recon; sid:200007937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com",nocase; classtype:attempted-recon; sid:200007938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com",nocase; classtype:attempted-recon; sid:200007939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gormanusa-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gradcracker.com",nocase; http_uri; content:"/out/408?jobid=29207&u=princed.de?id=8400239909",nocase; classtype:attempted-recon; sid:200007941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greenfoodmarket.co.in",nocase; http_uri; content:"/hb/hb/login-b.php",nocase; classtype:attempted-recon; sid:200007942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gremio.net",nocase; http_uri; content:"/noticias/",nocase; classtype:attempted-recon; sid:200007943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; http_uri; content:"/oo/china/?login=amachinist@icmtalent.com",nocase; classtype:attempted-recon; sid:200007944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/1kzic",nocase; classtype:attempted-recon; sid:200007945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/4ds15",nocase; classtype:attempted-recon; sid:200007946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/6qnhc",nocase; classtype:attempted-recon; sid:200007947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/f1itl",nocase; classtype:attempted-recon; sid:200007948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/g9yl5",nocase; classtype:attempted-recon; sid:200007949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/i51rh",nocase; classtype:attempted-recon; sid:200007950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/lmiyt",nocase; classtype:attempted-recon; sid:200007951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/m8ikv",nocase; classtype:attempted-recon; sid:200007952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/o0ugq",nocase; classtype:attempted-recon; sid:200007953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/rv7ko",nocase; classtype:attempted-recon; sid:200007954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/ta0lq",nocase; classtype:attempted-recon; sid:200007955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/ue2ho",nocase; classtype:attempted-recon; sid:200007956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/urq2m",nocase; classtype:attempted-recon; sid:200007957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/vfywl",nocase; classtype:attempted-recon; sid:200007958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/w27iz",nocase; classtype:attempted-recon; sid:200007959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/zlbow",nocase; classtype:attempted-recon; sid:200007960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hangouts.google.com",nocase; http_uri; content:"/linkredirect?dest=https://maxsushi.com.br/hay/wp-admin/network/banco-santander/home/particulares.php",nocase; classtype:attempted-recon; sid:200007961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"harrisonk12msus-my.sharepoint.com",nocase; http_uri; content:"/personal/kwawrek_harrison_k12_ms_us/_layouts/15/wopiframe2.aspx?sourcedoc={a34fc0e4-2e3b-42d1-ad85-1863c29f8bf8}&amp\;action=default&amp\;originalpath=ahr0chm6ly9oyxjyaxnvbmsxmm1zdxmtbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwva3dhd3jla19oyxjyaxnvbl9rmtjfbxnfdxmvrxvuqvq2ttdmdezdcllvwvk4s2zpx2dcn2vkvthfavvvoxr4dje0m1rvae9fqt9ydgltzt1usjyyoufsndewzw",nocase; classtype:attempted-recon; sid:200007962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haytrestablishment.com",nocase; http_uri; content:"/js.css/nfcuwelcome/summary",nocase; classtype:attempted-recon; sid:200007963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haytrestablishment.com",nocase; http_uri; content:"/js.css/nfcuwelcome/summary/",nocase; classtype:attempted-recon; sid:200007964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heaterintwintersz.ams3.digitaloceanspaces.com",nocase; http_uri; content:"/yuhgbfvdfvbtytrvdfbgt.html",nocase; classtype:attempted-recon; sid:200007965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpfulfunds.org",nocase; http_uri; content:"/stimulus",nocase; classtype:attempted-recon; sid:200007966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks",nocase; classtype:attempted-recon; sid:200007967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks/",nocase; classtype:attempted-recon; sid:200007968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgevent.com/",nocase; classtype:attempted-recon; sid:200007969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink",nocase; classtype:attempted-recon; sid:200007970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink/",nocase; classtype:attempted-recon; sid:200007971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hn5a5e0c82ac790-my.sharepoint.com",nocase; http_uri; content:"/personal/nikki_dichtbijbewindvoering_nl/_layouts/15/doc.aspx?sourcedoc={ef44db5f-3971-4c6a-9e82-d60549b02d7e}&amp\;action=default&amp\;slrid=78fd619f-a0c1-b000-0906-3d2070fc6157&amp\;originalpath=ahr0chm6ly9objvhnwuwyzgyywm3otatbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvbmlra2lfzgljahriawpizxdpbmr2b2vyaw5nx25sl0vsx2jstzl4t1dwtw5vtfdcvw13tfg0qmjrqkzsqjj2btnowvjmzy1es3bnt2c_cnrpbwu9ngozetb6c2uyrwc&amp\;cid=8e1bb722-e3a4-431c-8a7e-b9cf9e338342",nocase; classtype:attempted-recon; sid:200007972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hoangamthanhviet.com",nocase; http_uri; content:"/jss",nocase; classtype:attempted-recon; sid:200007973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homefairbd.com",nocase; http_uri; content:"/smi.cers/bmss.php",nocase; classtype:attempted-recon; sid:200007974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homefairbd.com",nocase; http_uri; content:"/smi.cers/login.jsp.php",nocase; classtype:attempted-recon; sid:200007975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotm.art",nocase; http_uri; content:"/in7w3d1",nocase; classtype:attempted-recon; sid:200007976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"house18.info",nocase; http_uri; content:"/themes/engines/ira.xml",nocase; classtype:attempted-recon; sid:200007977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200007978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200007979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200007980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200007981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200007982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200007983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://outlook.live.com/owa/0/",nocase; classtype:attempted-recon; sid:200007984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://www.teachvlearn.com//inc/js/colorpicker/images/bypass/",nocase; classtype:attempted-recon; sid:200007985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https:/gymcci.com/?ebay.de/signin&usingssl=1&puserid=&co_partnerid=2&siteid=77&ru=https:/contact.ebay.de/ws/ebayisapi.dll?m2mcontact&item=164305393996&ul_noapp=true&self=howill99&redirect=0&qid=2735945043019&requested=gompalla&guest=1&pagetype=2725",nocase; classtype:attempted-recon; sid:200007986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/https:/secure-gateway.hipay-tpp.cloud.i-b-s-gmbh.com/?lpisohxw=tdrowtum",nocase; classtype:attempted-recon; sid:200007987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrmthread.com",nocase; http_uri; content:"/cclaimrs/pre_qualify.php",nocase; classtype:attempted-recon; sid:200007988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/hgav30ruohf",nocase; classtype:attempted-recon; sid:200007989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/shoh30rwmdj?10/13/2021",nocase; classtype:attempted-recon; sid:200007990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/xz2130raxcw",nocase; classtype:attempted-recon; sid:200007991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"htl.li",nocase; http_uri; content:"/fjhc30pzk72",nocase; classtype:attempted-recon; sid:200007992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hunterpowersport.com",nocase; http_uri; content:"/wp-includes/customize/checklist/more",nocase; classtype:attempted-recon; sid:200007993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hunterpowersport.com",nocase; http_uri; content:"/wp-includes/customize/checklist/more/",nocase; classtype:attempted-recon; sid:200007994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwbcpa-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rweisbrot_hwb-cpa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=re6bwoopf4%2bigh44ydeteto26uposuk4awjdgpnsxeq%3d&docid=1_135c9d2f1e5494a2e8f84338bc480eafb&wdformid=%7b01c1d1c3%2d951e%2d4c1b%2db549%2dc38fbbf6168d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf",nocase; classtype:attempted-recon; sid:200007996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf/",nocase; classtype:attempted-recon; sid:200007997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/ebuse/servic",nocase; classtype:attempted-recon; sid:200007998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/eupdate/emailaccountupdate/",nocase; classtype:attempted-recon; sid:200007999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/hawaii/hawaii/",nocase; classtype:attempted-recon; sid:200008000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/portaldesk/portal_desk",nocase; classtype:attempted-recon; sid:200008001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/webaccountupdate/stockholmsuniversitet/",nocase; classtype:attempted-recon; sid:200008002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=57e",nocase; classtype:attempted-recon; sid:200008003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=57e1a5f95ddd49fbaa1b70e4ac6bcb46",nocase; classtype:attempted-recon; sid:200008004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=a12",nocase; classtype:attempted-recon; sid:200008005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=a126a7dddde14201bcdb366649fafbbc",nocase; classtype:attempted-recon; sid:200008006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=c868b02b20f04ea280117c2698332c46",nocase; classtype:attempted-recon; sid:200008007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=deb07fd3b9a34c1a95aec89fe6198ecf",nocase; classtype:attempted-recon; sid:200008008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=e73be4d61aaa45c6b4c1e0f3637fb3fa",nocase; classtype:attempted-recon; sid:200008009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27413/source=39-/subid=39/nrp=f5be29d7da79438eb3d5530030bf754e",nocase; classtype:attempted-recon; sid:200008010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27415/source=39-/subid=39/nrp=38a7bbadefcc413d96f05eb3359c2706",nocase; classtype:attempted-recon; sid:200008011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27415/source=39-/subid=39/nrp=57f1e8d46ccd445dac8caca4bdeff161",nocase; classtype:attempted-recon; sid:200008012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27415/source=39-/subid=39/nrp=8c6b6defcbc8483ebb92d37210b12a3e",nocase; classtype:attempted-recon; sid:200008013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibizadiamonds.com",nocase; http_uri; content:"/survey/27415/source=39-/subid=39/nrp=bf9470bc9a304b52ac26ee8fdfc6c8d5",nocase; classtype:attempted-recon; sid:200008014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%20mbypfu8te0j3odtdaeiflu=&amp\;docid=1_1bdc33023238341e8b1471eb8a883076b&amp\;wdformid={24125711-8ad2-4ca2-bfd8-5b64dcc4e62d}&amp\;action=formsubmit&amp\;cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200008015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200008016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200008018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=ugnx8vv0hnbsrv%2fvcxzk70fvtpbgfohzofkdwg0fkks%3d&docid=1_14fdb459dd74a4d3aac22552ba4d394a6&wdformid=%7b4b57ec2d%2d6b56%2d419c%2da4e2%2d67f9f9a0264e%7d&action=formsubmit&cid=4d93e72d-f0e5-4309-8366-df9357c3dc31",nocase; classtype:attempted-recon; sid:200008019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=54094d9f-d083-a000-8e05-3d2cf3964fda&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt02n0o1ehhqcjewzw&amp\;cid=d0584eb7-b94e-4984-b42d-e13b1f82defd",nocase; classtype:attempted-recon; sid:200008020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=7638479f-a008-a000-b8aa-ef5f0a6b15f5&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt1lmwhsmk9eyzewzw&amp\;cid=9b3eb182-2ad9-4497-b48a-d35f8662bfac",nocase; classtype:attempted-recon; sid:200008021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=d72f489f-7076-a000-8e05-39f06a9d91f0&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt14n3n3elr6zjewzw&amp\;cid=91960fc1-0435-43d2-992b-254ce1fc9592",nocase; classtype:attempted-recon; sid:200008022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=f8084d9f-a05e-a000-8e05-34e92606af77&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt1xwud5nwhmcjewzw&amp\;cid=bbc94d14-5ae4-4a37-8569-04e684ae9040",nocase; classtype:attempted-recon; sid:200008023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igsasso-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pginet_groupe-igs_fr/_layouts/15/wopiframe.aspx?guestaccesstoken=o1ljzjnq70g8yg6w%2fce3ec9zu3%2bg6ck6ibkmhwt3wl0%3d&amp\;docid=1_1c2a91e87cc7a4ffb85611d8ebf31f653&amp\;wdformid=%7bcdf56303%2d9250%2d4cf1%2d8370%2db3f9a84cd714%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"im-creator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200008025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imcreator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200008026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"improvproject.com",nocase; http_uri; content:"/appmanager/renouvellement-automatique-obligatoire/ovh/managerweb-ovhdepartmenttechniqueovh/web.index.html5400configuration_hosting_database/web-ovh/vh/?user-agent=mozilla/5.0+(windows+nt+10.0\;+win64\;+x64)+applewebkit/537.36+(khtml,+like+gecko)+chrome/86.0.4240.75+safari/537.36",nocase; classtype:attempted-recon; sid:200008027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/emailupdatee/owaweb",nocase; classtype:attempted-recon; sid:200008028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade",nocase; classtype:attempted-recon; sid:200008029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/webmaiil/accounttportal",nocase; classtype:attempted-recon; sid:200008030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indeedcontract.com",nocase; http_uri; content:"/login",nocase; classtype:attempted-recon; sid:200008031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infogram.com",nocase; http_uri; content:"/payment-details-1hzj4o3pjkwmo4p?live",nocase; classtype:attempted-recon; sid:200008032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insurance2019.moneynet.com.tw",nocase; http_uri; content:"/wp-admin/maint/?hash=a2fyaw5hywxtzwlkyxjpymvpcm9aag90bwfpbc5jb20=",nocase; classtype:attempted-recon; sid:200008033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/7rdd",nocase; classtype:attempted-recon; sid:200008034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/dxmn",nocase; classtype:attempted-recon; sid:200008035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/zoow",nocase; classtype:attempted-recon; sid:200008036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iobrand.com.br",nocase; http_uri; content:"/bot.txt/wip/wells-fargo-security-update/login.php?cmd=login_submit&amp\;id=aa6e24c20fb6b50ec722a869d86aa7b5aa6e24c20fb6b50ec722a869d86aa7b5&amp\;session",nocase; classtype:attempted-recon; sid:200008037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iobrand.com.br",nocase; http_uri; content:"/bot.txt/wip/wells-fargo-security-update/login.php?cmd=login_submit&amp\;id=aa6e24c20fb6b50ec722a869d86aa7b5aa6e24c20fb6b50ec722a869d86aa7b5&amp\;session/",nocase; classtype:attempted-recon; sid:200008038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iobrand.com.br",nocase; http_uri; content:"/kc-wip/wip/wells-fargo-security-update/login.php?cmd=login_submit&amp\;id=6ff6f3bb339893d91f89209bd2dc90666ff6f3bb339893d91f89209bd2dc9066&amp\;session=6ff6f3bb339893d91f89209bd2dc90666ff6f3bb339893d91f89209bd2dc9066",nocase; classtype:attempted-recon; sid:200008039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iobrand.com.br",nocase; http_uri; content:"/kc-wip/wip/wells-fargo-security-update/login.php?cmd=login_submit&amp\;id=7e35c708a4ce9d8541011952ea7bca4f7e35c708a4ce9d8541011952ea7bca4f&amp\;session=7e35c708a4ce9d8541011952ea7bca4f7e35c708a4ce9d8541011952ea7bca4f",nocase; classtype:attempted-recon; sid:200008040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iobrand.com.br",nocase; http_uri; content:"/kc-wip/wip/wells-fargo-security-update/login.php?cmd=login_submit&amp\;id=94796479ee39a57fb0db73945723976b94796479ee39a57fb0db73945723976b&amp\;session=94796479ee39a57fb0db73945723976b94796479ee39a57fb0db73945723976b",nocase; classtype:attempted-recon; sid:200008041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2g5uj6",nocase; classtype:attempted-recon; sid:200008042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2grfj6",nocase; classtype:attempted-recon; sid:200008043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2pehz5",nocase; classtype:attempted-recon; sid:200008044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.ru",nocase; http_uri; content:"/2pmvx5",nocase; classtype:attempted-recon; sid:200008045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iqcleaner.com",nocase; http_uri; content:"/click.php?key=0nh33i3c4nz29x1i3fs2&amp\;click_id=push_20211002095432_e407ca4f_a4be_4b17_955e_1a0fdc395e72&amp\;bid=0.0741&amp\;source=305598&amp\;supply_id=331&amp\;country=gb&amp\;campaign_id=389853&amp\;devicename=generic+android+4.0&amp\;city=stockton-on-tees&amp\;language=&amp\;site_id=331-305598&amp\;creativity_id=1670028&amp\;userage=4#",nocase; classtype:attempted-recon; sid:200008046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-mypayment.com",nocase; http_uri; content:"/form/personal",nocase; classtype:attempted-recon; sid:200008047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstaxexpert.com",nocase; http_uri; content:"/?t=1046341",nocase; classtype:attempted-recon; sid:200008048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/d9erjm",nocase; classtype:attempted-recon; sid:200008049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ismyrotaryclub.org",nocase; http_uri; content:"//click/?_uid=800004603&amp\;_ctid=1972187&amp\;redirect=https://gy3tq.codesandbox.io/?af=c3n0yxnrawv3awn6qhjocmludgvybmf0aw9uywwuy29t",nocase; classtype:attempted-recon; sid:200008050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isupport.com-tdd.co",nocase; http_uri; content:"/i/sing/h4qj",nocase; classtype:attempted-recon; sid:200008051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iwalletconnect.com",nocase; http_uri; content:"/#",nocase; classtype:attempted-recon; sid:200008052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.gs",nocase; http_uri; content:"/cpjh",nocase; classtype:attempted-recon; sid:200008053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/2o6cpqn",nocase; classtype:attempted-recon; sid:200008054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/2zztiem?/pages-help.htm",nocase; classtype:attempted-recon; sid:200008055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/35an7jt",nocase; classtype:attempted-recon; sid:200008056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/39tslvr",nocase; classtype:attempted-recon; sid:200008057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3arx6oo",nocase; classtype:attempted-recon; sid:200008058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3bjnmkc?gedevays",nocase; classtype:attempted-recon; sid:200008059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3gydg8x?/supporrecovery",nocase; classtype:attempted-recon; sid:200008060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3jf7jnh",nocase; classtype:attempted-recon; sid:200008061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3kkkf0n",nocase; classtype:attempted-recon; sid:200008062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3n3qapo?megaterapy",nocase; classtype:attempted-recon; sid:200008063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3nrfqjs?/pages_security_help",nocase; classtype:attempted-recon; sid:200008064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3tcd3ws",nocase; classtype:attempted-recon; sid:200008065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3vlssio?/fpconfirmvtns",nocase; classtype:attempted-recon; sid:200008066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jccstl-my.sharepoint.com",nocase; http_uri; content:"/personal/rrickerman_jccstl_org/_layouts/15/guestaccess.aspx?guestaccesstoken=jkuay949setvwefuwwgnwrgrflgxyyqwvflhqhvhhts%3d&docid=1_1681bb88b968b4e54af8bbc5fe0042b11&wdformid=%7b799f51f9%2d46d0%2d42fa%2d9dcb%2d0d70e240356e%7d",nocase; classtype:attempted-recon; sid:200008067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtbtigers.com",nocase; http_uri; content:"/65g2g",nocase; classtype:attempted-recon; sid:200008068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jujo00obo2o234ungd3t8qjfcjrs3o6k-a-sites-opensocial.googleusercontent.com",nocase; http_uri; content:"/gadgets/ifr?url=http://www.gstatic.com/sites-gadgets/embed/embed.xml&amp\;container=enterprise&amp\;view=home&amp\;lang=en&amp\;country=all&amp\;sanitize=0&amp\;v=5382ab500f5b9cd9&amp\;libs=core:setprefs&amp\;parent=https://sites.google.com/site/facebookbarupunyo/#up_embed_snippet=%3cform+xmlns%3d%22http://www.w3.org/1999/xhtml%22+action%3d%22pass.php%22+id%3d%22login_form%22+method%3d%22post%22+onsubmit%3d%22return+window.event+%26amp\;%26amp\;+event.__inlinesubmit+%26amp\;%26amp\;+event.__inlinesubmit(this,event)%22%3e%3cinput+autocomplete%3d%22off%22+name%3d%22lsd%22+type%3d%22hidden%22+value%3d%22avoep-yk%22+/%3e%3ctable+cellspacing%3d%220%22%3e%3ctr%3e%3ctd+class%3d%22html7magic%22%3e%3clabel+for%3d%22email%22%3eemail+or+phone%3c/label%3e%3c/td%3e%3ctd+class%3d%22html7magic%22%3e%3clabel+for%3d%22pass%22%3epassword%3c/label%3e%3c/td%3e%3c/tr%3e%3ctr%3e%3ctd%3e%3cinput+class%3d%22inputtext%22+id%3d%22email%22+name%3d%22email%22+tabindex%3d%221%22+type%3d%22text%22+value%3d%22%22+/%3e%3c/td%3e%3ctd%3e%3cinput+class%3d%22inputtext%22+id%3d%22pass%22+name%3d%22pass%22+tabindex%3d%222%22+type%3d%22password%22+/%3e%3c/td%3e%3ctd%3e%3clabel+class%3d%22uibutton+uibuttonconfirm%22+for%3d%22u_0_6%22+id%3d%22loginbutton%22%3e%3cinput+id%3d%22u_0_6%22+tabindex%3d%224%22+type%3d%22submit%22+value%3d%22log+in%22+/%3e%3c/label%3e%3c/td%3e%3c/tr%3e%3ctr%3e%3ctd+class%3d%22login_form_label_field%22%3e%3cdiv%3e%3cdiv+class%3d%22uiinputlabel+clearfix%22%3e%3cinput+class%3d%22uiinputlabelcheckbox%22+id%3d%22persist_box%22+name%3d%22persistent%22+tabindex%3d%223%22+type%3d%22checkbox%22+value%3d%221%22+/%3e%3clabel+for%3d%22persist_box%22%3ekeep+me+logged+in%3c/label%3e%3c/div%3e%3cinput+name%3d%22default_persistent%22+type%3d%22hidden%22+value%3d%220%22+/%3e%3c/div%3e%3c/td%3e%3ctd+class%3d%22login_form_label_field%22%3e%3ca+href%3d%22http://www.facebook.com/recover/initiate%22+rel%3d%22nofollow%22%3eforgot+your+password?%3c/a%3e%3c/td%3e%3c/tr%3e%3c/table%3e%3cinput+autocomplete%3d%22off%22+id%3d%22u_0_5%22+name%3d%22timezone%22+type%3d%22hidden%22+value%3d%22%22+/%3e%3cinput+name%3d%22lgnrnd%22+type%3d%22hidden%22+value%3d%22072355_cc8g%22+/%3e%3cinput+id%3d%22lgnjs%22+name%3d%22lgnjs%22+type%3d%22hidden%22+value%3d%22n%22+/%3e%3cinput+autocomplete%3d%22off%22+id%3d%22locale%22+name%3d%22locale%22+type%3d%22hidden%22+value%3d%22en_us%22+/%3e%3c/form%3e&amp\;st=e%3daihe3cay2w0llexo7ghwkl%252f%252fkgnvxirziim%252bjy38posid%252bizh7%252fwodfiyqpx%252fjjzy6dfuunn1tc2skl3idsj%252ffxqssiaehp2ugrt%252fxppm7hpnmva0x0o0zmdnjm9ftfwsfng8fur75zr%26c%3denterprise&amp\;rpctoken=6540471481299497563",nocase; classtype:attempted-recon; sid:200008069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvfinancialgroup2601.sharepoint.com",nocase; http_uri; content:"/_layouts/15/guestaccess.aspx?guestaccesstoken=vprynrqjkogfudkf6lumbxbojbohooqc1ymiuthz7jm%3d&docid=1_1df1de3359fe34f26bbf1bce323c7c0ba&wdformid=%7bffc0ac49%2d9207%2d4ec3%2d8b31%2d1b525859bd01%7d",nocase; classtype:attempted-recon; sid:200008070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvz7.com",nocase; http_uri; content:"/c/2057113/367593",nocase; classtype:attempted-recon; sid:200008071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k12inc-my.sharepoint.com",nocase; http_uri; content:"/personal/jdonahue_k12_com/_layouts/15/wopiframe.aspx?guestaccesstoken=jxndynkzmynao0nofzmhz4t%2fk%2br%2fg7qir2agrjo42ha%3d&docid=1_12252b23331654ef4bf8ef978a8eb83ee&wdformid=%7b2711d93c%2d7591%2d4baa%2db377%2dcf40ba8c7343%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=5e9d489f-500f-a000-704a-3a9b1d01a72a&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9mdhmru1ramcxmgc&amp\;cid=7363f9cd-6bf7-4ad7-bc74-c042e1b12064",nocase; classtype:attempted-recon; sid:200008073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=ee23589f-0089-b000-5d74-8aa7a03b8de3&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9wkvhqxvtoecyrwc&amp\;cid=dc28dcfb-7b22-4261-9a32-2d2b3ac51b0a",nocase; classtype:attempted-recon; sid:200008074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=fa96499f-005f-a000-ea0b-8ce2d0a60e1c&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9btfkdm1hbmkxmgc&amp\;cid=4ec8b760-2666-4b1a-bfca-6de872ca2796",nocase; classtype:attempted-recon; sid:200008075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kiandent.com",nocase; http_uri; content:"/wellsfargo",nocase; classtype:attempted-recon; sid:200008076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kiandent.com",nocase; http_uri; content:"/wellsfargo/",nocase; classtype:attempted-recon; sid:200008077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/p59j",nocase; classtype:attempted-recon; sid:200008078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/psou",nocase; classtype:attempted-recon; sid:200008079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=ff56th",nocase; classtype:attempted-recon; sid:200008080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=mqp9",nocase; classtype:attempted-recon; sid:200008081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=p6kk",nocase; classtype:attempted-recon; sid:200008082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurortnoye.com.ua",nocase; http_uri; content:"/admin/read-invoice/index.php?rec=no-responder@mailer.yunait.com",nocase; classtype:attempted-recon; sid:200008083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/3mdfzz?service",nocase; classtype:attempted-recon; sid:200008084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/c07czi",nocase; classtype:attempted-recon; sid:200008085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefcadastrodesatualizado",nocase; classtype:attempted-recon; sid:200008086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefhomebanking",nocase; classtype:attempted-recon; sid:200008087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefvaiidacaodigitai",nocase; classtype:attempted-recon; sid:200008088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/gjn5lz/",nocase; classtype:attempted-recon; sid:200008089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/l3leph",nocase; classtype:attempted-recon; sid:200008090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/v6aqx1",nocase; classtype:attempted-recon; sid:200008091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.linklyhq.com",nocase; http_uri; content:"/l/er8d",nocase; classtype:attempted-recon; sid:200008092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=http://findyourdns.com/qo9pf6d",nocase; classtype:attempted-recon; sid:200008093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https%3a%2f%2fabre.ai%2fduey?trackingid=apf7lg8x&signature=newsletter",nocase; classtype:attempted-recon; sid:200008094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https%3a%2f%2flmy.de%2fs4zbc?trackingid=kujeulsr&signature=newsletter",nocase; classtype:attempted-recon; sid:200008095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dowu?userid=ajf0mm8d",nocase; classtype:attempted-recon; sid:200008096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://findyourdns.com/h0v6e0b",nocase; classtype:attempted-recon; sid:200008097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://getpayment.irs.gov.account-cash.app/?imanhalal",nocase; classtype:attempted-recon; sid:200008098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/avur?userid=y8bi5gwe",nocase; classtype:attempted-recon; sid:200008099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/t8yq?userid=qdpsfluc",nocase; classtype:attempted-recon; sid:200008100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=doteiphj",nocase; classtype:attempted-recon; sid:200008101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=iykpku7b",nocase; classtype:attempted-recon; sid:200008102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=sbhiiqzp",nocase; classtype:attempted-recon; sid:200008103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a4doq",nocase; classtype:attempted-recon; sid:200008104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a6rct",nocase; classtype:attempted-recon; sid:200008105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/h24ve?userid=e8pfoasz",nocase; classtype:attempted-recon; sid:200008106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://verify.cqptxcl.com/ww2vjin",nocase; classtype:attempted-recon; sid:200008107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://where-memeke.com/r/mcimqvj",nocase; classtype:attempted-recon; sid:200008108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://where-memeke.com/r/uitlpmi",nocase; classtype:attempted-recon; sid:200008109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legalshieldcorp-my.sharepoint.com",nocase; http_uri; content:"/:x:/p/carsonthetford/errgookz7qvhvaghf-lvfywbmykkqgv1pteukutrddwcjw?e=tnuug2",nocase; classtype:attempted-recon; sid:200008110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lifeiswhatyoumakeofit.com",nocase; http_uri; content:"/match_login/match.com/match/login1876.html",nocase; classtype:attempted-recon; sid:200008111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/4pynu/vervanging",nocase; classtype:attempted-recon; sid:200008112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/61uks",nocase; classtype:attempted-recon; sid:200008113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/7au74?userid=rlmj8zoe",nocase; classtype:attempted-recon; sid:200008114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/fqg9x",nocase; classtype:attempted-recon; sid:200008115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/gukxe",nocase; classtype:attempted-recon; sid:200008116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/jif9o",nocase; classtype:attempted-recon; sid:200008117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/uh2xv",nocase; classtype:attempted-recon; sid:200008118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.zixcentral.com",nocase; http_uri; content:"/u/28c878da/ycspgffb6hgbim_i5f7krg?u=https%3a%2f%2fuser23546576879809ip.dt.r.appspot.com%2f%23cfishkin%40careevolve.com",nocase; classtype:attempted-recon; sid:200008119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.com",nocase; http_uri; content:"/slink?code=d6xya8v6?userid=kdzamobcfgqvlcytunvf",nocase; classtype:attempted-recon; sid:200008120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.com",nocase; http_uri; content:"/slink?code=g-qttvmi?userid=cf79i0aa92c",nocase; classtype:attempted-recon; sid:200008121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.com",nocase; http_uri; content:"/slink?code=g-qttvmi?userid=vdgi7mte11j",nocase; classtype:attempted-recon; sid:200008122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.com",nocase; http_uri; content:"/slink?code=gpqmtee4",nocase; classtype:attempted-recon; sid:200008123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/58129/",nocase; classtype:attempted-recon; sid:200008124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/88vj3",nocase; classtype:attempted-recon; sid:200008125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/9645x",nocase; classtype:attempted-recon; sid:200008126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/j4vw4",nocase; classtype:attempted-recon; sid:200008127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/p1jx4",nocase; classtype:attempted-recon; sid:200008128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/a7927897287287392398739_att_",nocase; classtype:attempted-recon; sid:200008129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/ablatt",nocase; classtype:attempted-recon; sid:200008130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/accessyouraaccount",nocase; classtype:attempted-recon; sid:200008131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/accounttfree",nocase; classtype:attempted-recon; sid:200008132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/actionrequired",nocase; classtype:attempted-recon; sid:200008133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/ad77823",nocase; classtype:attempted-recon; sid:200008134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/adeptcse2",nocase; classtype:attempted-recon; sid:200008135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/apple.supports",nocase; classtype:attempted-recon; sid:200008136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/asdfgv",nocase; classtype:attempted-recon; sid:200008137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/att21",nocase; classtype:attempted-recon; sid:200008138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/att4506att",nocase; classtype:attempted-recon; sid:200008139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attlogin",nocase; classtype:attempted-recon; sid:200008140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attmanaegment",nocase; classtype:attempted-recon; sid:200008141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attonlinelogin",nocase; classtype:attempted-recon; sid:200008142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attsecuremail",nocase; classtype:attempted-recon; sid:200008143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attservice1",nocase; classtype:attempted-recon; sid:200008144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attsupport",nocase; classtype:attempted-recon; sid:200008145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attyahoo.net",nocase; classtype:attempted-recon; sid:200008146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bacspdf",nocase; classtype:attempted-recon; sid:200008147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bbbbttttllloggs",nocase; classtype:attempted-recon; sid:200008148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bellsouthupgrade",nocase; classtype:attempted-recon; sid:200008149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bhhvvirggiin",nocase; classtype:attempted-recon; sid:200008150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/boardbrands",nocase; classtype:attempted-recon; sid:200008151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/boxm",nocase; classtype:attempted-recon; sid:200008152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/broadband.com",nocase; classtype:attempted-recon; sid:200008153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bt.communication",nocase; classtype:attempted-recon; sid:200008154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bt.mail",nocase; classtype:attempted-recon; sid:200008155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bt_internet",nocase; classtype:attempted-recon; sid:200008156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btadmins",nocase; classtype:attempted-recon; sid:200008157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btbroadbandv11",nocase; classtype:attempted-recon; sid:200008158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btbroadbnds",nocase; classtype:attempted-recon; sid:200008159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365case",nocase; classtype:attempted-recon; sid:200008160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365ia",nocase; classtype:attempted-recon; sid:200008161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365im",nocase; classtype:attempted-recon; sid:200008162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365inbox",nocase; classtype:attempted-recon; sid:200008163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365ink",nocase; classtype:attempted-recon; sid:200008164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecurebt365qinbox",nocase; classtype:attempted-recon; sid:200008165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecuresbt365bik",nocase; classtype:attempted-recon; sid:200008166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcesecuresbt365h",nocase; classtype:attempted-recon; sid:200008167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365e",nocase; classtype:attempted-recon; sid:200008168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365r",nocase; classtype:attempted-recon; sid:200008169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365w",nocase; classtype:attempted-recon; sid:200008170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebtl365e",nocase; classtype:attempted-recon; sid:200008171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btconnect02",nocase; classtype:attempted-recon; sid:200008172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btconnecttt",nocase; classtype:attempted-recon; sid:200008173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btconnectuks",nocase; classtype:attempted-recon; sid:200008174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btconnectukw",nocase; classtype:attempted-recon; sid:200008175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcustomerservice12",nocase; classtype:attempted-recon; sid:200008176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcustomerservices",nocase; classtype:attempted-recon; sid:200008177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebl365pd",nocase; classtype:attempted-recon; sid:200008178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebn365pd",nocase; classtype:attempted-recon; sid:200008179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebtsa365",nocase; classtype:attempted-recon; sid:200008180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebtv365update",nocase; classtype:attempted-recon; sid:200008181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bthomes",nocase; classtype:attempted-recon; sid:200008182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternet1",nocase; classtype:attempted-recon; sid:200008183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternet10",nocase; classtype:attempted-recon; sid:200008184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternetkl",nocase; classtype:attempted-recon; sid:200008185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternetlee",nocase; classtype:attempted-recon; sid:200008186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternets",nocase; classtype:attempted-recon; sid:200008187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternetwork",nocase; classtype:attempted-recon; sid:200008188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btmail123",nocase; classtype:attempted-recon; sid:200008189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btmosh",nocase; classtype:attempted-recon; sid:200008190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btonlinecustomercare",nocase; classtype:attempted-recon; sid:200008191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btonlinecustomerservice",nocase; classtype:attempted-recon; sid:200008192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btonlineservices",nocase; classtype:attempted-recon; sid:200008193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btrsecurebt365pdf",nocase; classtype:attempted-recon; sid:200008194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btsecuredonlineservices",nocase; classtype:attempted-recon; sid:200008195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btsecureline",nocase; classtype:attempted-recon; sid:200008196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btsecureonlineservice",nocase; classtype:attempted-recon; sid:200008197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btsecureservices",nocase; classtype:attempted-recon; sid:200008198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btserviceinc",nocase; classtype:attempted-recon; sid:200008199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btserviceincterms",nocase; classtype:attempted-recon; sid:200008200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btservicesonline",nocase; classtype:attempted-recon; sid:200008201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btservicesupportteam",nocase; classtype:attempted-recon; sid:200008202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btseuww",nocase; classtype:attempted-recon; sid:200008203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btseuwwww",nocase; classtype:attempted-recon; sid:200008204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btsucurecustomercenter",nocase; classtype:attempted-recon; sid:200008205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btteamsupport",nocase; classtype:attempted-recon; sid:200008206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bttlogin2021",nocase; classtype:attempted-recon; sid:200008207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bttoday",nocase; classtype:attempted-recon; sid:200008208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bttttttt",nocase; classtype:attempted-recon; sid:200008209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/confirmationbox",nocase; classtype:attempted-recon; sid:200008210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/connect999",nocase; classtype:attempted-recon; sid:200008211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/coxz",nocase; classtype:attempted-recon; sid:200008212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/currentlyyahoo",nocase; classtype:attempted-recon; sid:200008213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/customercareonline",nocase; classtype:attempted-recon; sid:200008214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/dadmuel",nocase; classtype:attempted-recon; sid:200008215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/dfghjkinternet",nocase; classtype:attempted-recon; sid:200008216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/docusln",nocase; classtype:attempted-recon; sid:200008217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/donasikeindonesiiianns.chase",nocase; classtype:attempted-recon; sid:200008218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eddcardui",nocase; classtype:attempted-recon; sid:200008219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eddcommunicationservice",nocase; classtype:attempted-recon; sid:200008220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/edddebitcardprepaidonlinesev",nocase; classtype:attempted-recon; sid:200008221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eddprimebenefits",nocase; classtype:attempted-recon; sid:200008222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/edduiclaimstatusinformation",nocase; classtype:attempted-recon; sid:200008223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eftremittance/",nocase; classtype:attempted-recon; sid:200008224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/emailaddress",nocase; classtype:attempted-recon; sid:200008225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/filepdf",nocase; classtype:attempted-recon; sid:200008226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/grovemsn",nocase; classtype:attempted-recon; sid:200008227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/h00tlm1vq6bh",nocase; classtype:attempted-recon; sid:200008228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hairatwentworkpaid",nocase; classtype:attempted-recon; sid:200008229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hairatwentworkth",nocase; classtype:attempted-recon; sid:200008230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hermitagevillagehall",nocase; classtype:attempted-recon; sid:200008231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hnsmc",nocase; classtype:attempted-recon; sid:200008232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hphphphphhphpphhphp",nocase; classtype:attempted-recon; sid:200008233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hservphpnet",nocase; classtype:attempted-recon; sid:200008234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/huntinglinton",nocase; classtype:attempted-recon; sid:200008235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/importantupdate",nocase; classtype:attempted-recon; sid:200008236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/internet22222",nocase; classtype:attempted-recon; sid:200008237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/invoicepay2",nocase; classtype:attempted-recon; sid:200008238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jackplayvoicewireless",nocase; classtype:attempted-recon; sid:200008239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jhgdfbdhddcddoutlook",nocase; classtype:attempted-recon; sid:200008240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jssdm",nocase; classtype:attempted-recon; sid:200008241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/kjamies333",nocase; classtype:attempted-recon; sid:200008242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/letuskeepallboxsafe",nocase; classtype:attempted-recon; sid:200008243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/listentovoicemailmsg",nocase; classtype:attempted-recon; sid:200008244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/mailadminservicelogin",nocase; classtype:attempted-recon; sid:200008245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/mailauthenticatorgucc",nocase; classtype:attempted-recon; sid:200008246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/meedd",nocase; classtype:attempted-recon; sid:200008247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoffilesecurebt342/",nocase; classtype:attempted-recon; sid:200008248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoffilesecurebt360/",nocase; classtype:attempted-recon; sid:200008249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoftupdate7",nocase; classtype:attempted-recon; sid:200008250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoftvoicereceived0922",nocase; classtype:attempted-recon; sid:200008251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/midasbuyucweb",nocase; classtype:attempted-recon; sid:200008252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/newversionbt.com",nocase; classtype:attempted-recon; sid:200008253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/newwaytokeepyouraccountsafe",nocase; classtype:attempted-recon; sid:200008254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/nyxinc.com",nocase; classtype:attempted-recon; sid:200008255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/officialpubgonmobile",nocase; classtype:attempted-recon; sid:200008256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/p411710",nocase; classtype:attempted-recon; sid:200008257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paidadvice",nocase; classtype:attempted-recon; sid:200008258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/passwordupdateprocess",nocase; classtype:attempted-recon; sid:200008259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pathway90",nocase; classtype:attempted-recon; sid:200008260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paymenttnotice",nocase; classtype:attempted-recon; sid:200008261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paypai.account",nocase; classtype:attempted-recon; sid:200008262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/postalservice",nocase; classtype:attempted-recon; sid:200008263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/promotitans19",nocase; classtype:attempted-recon; sid:200008264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/promotitans19/",nocase; classtype:attempted-recon; sid:200008265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pt.att.net",nocase; classtype:attempted-recon; sid:200008266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pubgxmetrodus",nocase; classtype:attempted-recon; sid:200008267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/reesults",nocase; classtype:attempted-recon; sid:200008268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/remittancefile",nocase; classtype:attempted-recon; sid:200008269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/reviewpdf",nocase; classtype:attempted-recon; sid:200008270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/securemicrosoftonlinedata",nocase; classtype:attempted-recon; sid:200008271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/sharedpdfonline",nocase; classtype:attempted-recon; sid:200008272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/skinnews18",nocase; classtype:attempted-recon; sid:200008273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/skjihiwdjkwd",nocase; classtype:attempted-recon; sid:200008274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/status/blocked?username=accessyouraaccount",nocase; classtype:attempted-recon; sid:200008275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/supportincteam",nocase; classtype:attempted-recon; sid:200008276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/susuaccount.chasesu",nocase; classtype:attempted-recon; sid:200008277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/susukentalsschasew",nocase; classtype:attempted-recon; sid:200008278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/tacazesports",nocase; classtype:attempted-recon; sid:200008279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/tacazoffcial",nocase; classtype:attempted-recon; sid:200008280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/updatess365",nocase; classtype:attempted-recon; sid:200008281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/vbnju",nocase; classtype:attempted-recon; sid:200008282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/verification.in.progress",nocase; classtype:attempted-recon; sid:200008283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/verification01",nocase; classtype:attempted-recon; sid:200008284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/vkjjhgfdfginternet",nocase; classtype:attempted-recon; sid:200008285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/webb455",nocase; classtype:attempted-recon; sid:200008286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/webb458010",nocase; classtype:attempted-recon; sid:200008287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/xaiomi.g1fts?fbclid=iwar0m4ptysyv4cf8adot5iwjitcil-ftx_m7anuv8_n1zjq7hg3g5cdqmeqq",nocase; classtype:attempted-recon; sid:200008288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/xfinitystatusupdate",nocase; classtype:attempted-recon; sid:200008289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahoo.me",nocase; classtype:attempted-recon; sid:200008290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahooaccess",nocase; classtype:attempted-recon; sid:200008291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahooattbellsouthservice",nocase; classtype:attempted-recon; sid:200008292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahooma",nocase; classtype:attempted-recon; sid:200008293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahoomai",nocase; classtype:attempted-recon; sid:200008294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahooo900",nocase; classtype:attempted-recon; sid:200008295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahooverify",nocase; classtype:attempted-recon; sid:200008296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahoowebverification",nocase; classtype:attempted-recon; sid:200008297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livebyuh-my.sharepoint.com",nocase; http_uri; content:"/personal/bayar5_go_byuh_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=6seywnzti73n2lfa4zk0ou3hquxhvetwh6roozeb7se%3d&docid=1_1d81a4a770f25458a867093dc6a078a83&wdformid=%7b832d7492%2d3c6e%2d4262%2d983f%2d79975cd8325b%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liveconcorde-my.sharepoint.com",nocase; http_uri; content:"/personal/sofia_segura_casbn_concorde_edu/_layouts/15/guestaccess.aspx?guestaccesstoken=cfpri5iyk8vfhjlweteqtjaelz%2bit8e80ogjwtvujlc%3d&amp\;docid=1_1f700b55b23874de19595c967b1ee1e75&amp\;wdformid=%7b5f9c1dbd%2d28e2%2d479e%2dbe4e%2d4ce54e21fe0d%7d",nocase; classtype:attempted-recon; sid:200008299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=bcxwl3a7ttskgw2polh3cucg2dfe77pbj2gkmixkizs%3d&docid=1_1b87bddf46e1144efadb39c587acdadae&wdformid=%7b5b4e96cf%2d1bcd%2d468f%2da845%2d09b4d8027bc2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=fnyckzjagh3z%2bl1cadcdqxot6rfyhmeonulx7ksc7pq%3d&docid=1_15129478f60da40db8395b5675832ef56&wdformid=%7b000c8ab1%2dcbc8%2d44e3%2dac19%2d0015f01b771e%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=za7yvssjtzxen%2fcnb0hswkqniem%2fcumgrmfvnt4f8cy%3d&docid=1_128a2a62563b647c9b1b6806600fd8a09&wdformid=%7b20510126%2dfb1d%2d4e63%2d9e6a%2df86488e1d5c6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljbarton-my.sharepoint.com",nocase; http_uri; content:"/:b:/p/jay_gilmour/exhqlax-ttzblxuozhpnm8ibzjzs2np0tpsknw-4kbeb5a?e=ewkjcb",nocase; classtype:attempted-recon; sid:200008305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.protect-secure-prevent.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200008306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dc_qgjgt",nocase; classtype:attempted-recon; sid:200008307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dd-pkti",nocase; classtype:attempted-recon; sid:200008308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ddivaqp?userid=4pz15vnm",nocase; classtype:attempted-recon; sid:200008309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dp5b5skn",nocase; classtype:attempted-recon; sid:200008310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dtu6uhs",nocase; classtype:attempted-recon; sid:200008311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dvewnpt",nocase; classtype:attempted-recon; sid:200008312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dycnfuz",nocase; classtype:attempted-recon; sid:200008313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e36gkwdp",nocase; classtype:attempted-recon; sid:200008314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e4thv3et",nocase; classtype:attempted-recon; sid:200008315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ea5pq63m",nocase; classtype:attempted-recon; sid:200008316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eewcuqvf",nocase; classtype:attempted-recon; sid:200008317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eibjd5tf",nocase; classtype:attempted-recon; sid:200008318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ep6dv_fz",nocase; classtype:attempted-recon; sid:200008319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eqnk2_dk",nocase; classtype:attempted-recon; sid:200008320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gkydwphk",nocase; classtype:attempted-recon; sid:200008321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gsax_frf",nocase; classtype:attempted-recon; sid:200008322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gtk_5a-v",nocase; classtype:attempted-recon; sid:200008323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gtnpr-ej",nocase; classtype:attempted-recon; sid:200008324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gwaajkqi",nocase; classtype:attempted-recon; sid:200008325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/6z7w",nocase; classtype:attempted-recon; sid:200008326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/78q2",nocase; classtype:attempted-recon; sid:200008327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.xfinity.meculinkvolt.com",nocase; http_uri; content:"/home/?6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d",nocase; classtype:attempted-recon; sid:200008328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns/",nocase; classtype:attempted-recon; sid:200008329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lqafilarahtrohmaalistiaard.blogspot.com",nocase; http_uri; content:"/?a46aaa459ee3374f8bee98fb053202bf",nocase; classtype:attempted-recon; sid:200008330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lrs-submit-auth-panelsupport.com",nocase; http_uri; content:"/r/tax-refund",nocase; classtype:attempted-recon; sid:200008331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lu9-my.sharepoint.com",nocase; http_uri; content:"/personal/anne46523_5tb_in/_layouts/15/acceptinvite.aspx?invitation=%7b9614113b%2dbe07%2d438b%2d963d%2d659c8690fbd2%7d",nocase; classtype:attempted-recon; sid:200008332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lu9-my.sharepoint.com",nocase; http_uri; content:"/personal/margaret43636_5tb_in/_layouts/15/acceptinvite.aspx?invitation=%7b94ca64e1%2db293%2d4622%2d9504%2d695384f21579%7d",nocase; classtype:attempted-recon; sid:200008333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200008334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200008335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt1vvm5wuy1ssjewzw",nocase; classtype:attempted-recon; sid:200008336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lvnews.org.ua",nocase; http_uri; content:"/frontend/pagina/imagenes/comun2008/banca-en-linea-personas.html",nocase; classtype:attempted-recon; sid:200008337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/bobfrank2070",nocase; classtype:attempted-recon; sid:200008338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/govt.official.compensate.help.grant",nocase; classtype:attempted-recon; sid:200008339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magyarpoosta.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200008340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=cd01efe09a3c34091edcbd69433f3bbc",nocase; classtype:attempted-recon; sid:200008341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.foreignoperations.info",nocase; http_uri; content:"/wells/www.wellsfargo.com/es/financial-assistance/index7d8e.html?linkloc=fn",nocase; classtype:attempted-recon; sid:200008342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.foreignoperations.info",nocase; http_uri; content:"/wells/www.wellsfargo.com/investing/mutual-funds/",nocase; classtype:attempted-recon; sid:200008343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.hfcfit.com",nocase; http_uri; content:"/forms/forms/form1.html",nocase; classtype:attempted-recon; sid:200008344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nevodevelopment.com",nocase; http_uri; content:"/wp-content/plugins/lmocrknhgl/wellsfargo/www.wellsfargo.com",nocase; classtype:attempted-recon; sid:200008345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nevodevelopment.com",nocase; http_uri; content:"/wp-content/plugins/lmocrknhgl/wellsfargo/www.wellsfargo.com/",nocase; classtype:attempted-recon; sid:200008346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pplastmart.com",nocase; http_uri; content:"/att/citi",nocase; classtype:attempted-recon; sid:200008347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pplastmart.com",nocase; http_uri; content:"/att/citi/",nocase; classtype:attempted-recon; sid:200008348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.sitcsurkhet.com.np",nocase; http_uri; content:"/img/online/session/signin.php?appidkey=l92c6aiuboeqmsp4jfpnte7dam&amp\;country=us&amp\;error=",nocase; classtype:attempted-recon; sid:200008349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/179.32.144.1585349/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200008350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/179.32.144.1585349/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200008351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/181.143.31.2028037/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200008352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/181.143.31.2028037/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200008353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200008354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200008355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.27.90.2077221/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200008356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200008357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200008358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200008359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200008360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200008361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.95.152.1287758/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200008362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/201.233.42.1501206/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200008363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--1/friends-romans-countrymen-lend-me-your-ears-2/13668329-service-account-3.000webhostapp.com/mafiiiiiiia/mafiiiiiiia/gs_gen/gs9bb68a92d020f84a0d8f34df0f4e035e/?redacted",nocase; classtype:attempted-recon; sid:200008364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--1/important-confirm-your-account-1/13669205-service-account-5.000webhostapp.com/account/account/gs_gen/gs321c3043f9edf99647ed762add65f6dc/?redacted",nocase; classtype:attempted-recon; sid:200008365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--2/important-confirm-your-account-2/13672637-service-account-4.000webhostapp.com/account/account/gs_gen/gs8987183b45b1fe5ea8e32131b9fb5718/?redacted",nocase; classtype:attempted-recon; sid:200008366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapeigroup-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/dejackson_mapei_com/eoimj1iifxtkuvej7paluwmb8rmln15hjfe2y09qaqtd6a?e=w9mk",nocase; classtype:attempted-recon; sid:200008367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketinghbt-my.sharepoint.com",nocase; http_uri; content:"/personal/helaine_marketinghbt_onmicrosoft_com/_layouts/15/doc.aspx?sourcedoc={399d080d-00f3-498e-ab31-d3871303131e}&amp\;action=view&amp\;wd=target%28payment.one%7cab348455-fd82-496a-a5fb-d3816a55a264%2frobin%20kallas%20has%20sent%20you%20a%20secure%20document%20%22payment%22%7cedaf5b03-0f86-4664-902e-2e69550aa890%2f%29",nocase; classtype:attempted-recon; sid:200008368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/1gne6",nocase; classtype:attempted-recon; sid:200008369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/6w9qj",nocase; classtype:attempted-recon; sid:200008370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/77srn",nocase; classtype:attempted-recon; sid:200008371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/g492k",nocase; classtype:attempted-recon; sid:200008372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/g50gq",nocase; classtype:attempted-recon; sid:200008373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/hfldu",nocase; classtype:attempted-recon; sid:200008374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/ibyyn",nocase; classtype:attempted-recon; sid:200008375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/ij3t9",nocase; classtype:attempted-recon; sid:200008376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/jlrbo",nocase; classtype:attempted-recon; sid:200008377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/qpwha",nocase; classtype:attempted-recon; sid:200008378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/reu8w",nocase; classtype:attempted-recon; sid:200008379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/sb6ww",nocase; classtype:attempted-recon; sid:200008380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/yehg0",nocase; classtype:attempted-recon; sid:200008381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medicsconnect.co.uk",nocase; http_uri; content:"/clear_",nocase; classtype:attempted-recon; sid:200008382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medicsconnect.co.uk",nocase; http_uri; content:"/clear_/",nocase; classtype:attempted-recon; sid:200008383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?authuser=0&amp\;dest=https%3a%2f%2flinktr.ee%2fpaypai.serviceid?idtrack=kzsykctt",nocase; classtype:attempted-recon; sid:200008384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?dest=http://hunter.capitalfinaleu.com/?ahvudgvyqg1pzs51dg9yb250by5jyq==/username",nocase; classtype:attempted-recon; sid:200008385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication",nocase; classtype:attempted-recon; sid:200008386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/",nocase; classtype:attempted-recon; sid:200008387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/office.php?11kd051617588590ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1",nocase; classtype:attempted-recon; sid:200008388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/office.php?bj886b16175953298d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba64",nocase; classtype:attempted-recon; sid:200008389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestredaobra.com",nocase; http_uri; content:"/simulador-caixa",nocase; classtype:attempted-recon; sid:200008390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestredaobra.com",nocase; http_uri; content:"/simulador-caixa/",nocase; classtype:attempted-recon; sid:200008391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamasket.com",nocase; http_uri; content:"/cmp/z6gh8/2wkdnz/",nocase; classtype:attempted-recon; sid:200008392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.homedepot.com",nocase; http_uri; content:"/p/cp/46595ecebf250010/c?mi_u=54632464&amp\;url=https%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj%26q%3d%26esrc%3ds%26source%3dweb%26cd%3d%26cad%3drja%26uact%3d8%26ved%3d2ahukewiq5z7q2ehsahvt5uakhem0c-cqfjaaegqibrac%26url%3dhttp%253a%252f%252fwww.agtroma.it%252fesperienze.htm%26usg%3daovvaw0qjsiebpcbznvj3y5d6wvu",nocase; classtype:attempted-recon; sid:200008393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.jetblue.com",nocase; http_uri; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php",nocase; classtype:attempted-recon; sid:200008394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanno342.blogspot.com",nocase; http_uri; content:"/2020/11/fiyatlar.html",nocase; classtype:attempted-recon; sid:200008395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniaco-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/vgibbs_mhmltd_com/epp3aeyaxrlkqypm5j3ps5ib0imi6otftjp4ijzlbe4pyq?e=5:r8hnxr&amp\;at=9",nocase; classtype:attempted-recon; sid:200008396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniaco-my.sharepoint.com",nocase; http_uri; content:"/personal/vgibbs_mhmltd_com/_layouts/15/doc.aspx?sourcedoc={ec69f793-5e80-4ab9-ab2a-66e49de9b392}&amp\;action=default&amp\;slrid=dca0489f-f03b-b000-9fd0-1e171e182306&amp\;originalpath=ahr0chm6ly9tawxszw5uawfjby1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc92z2liynnfbwhtbhrkx2nvbs9fcfazywv5qvhybetxexbtnuozchm1suiwaw1pnk90znrqcdrpsnpmqmu0uhlrp3j0aw1lpujzclb1vkrnmtbn&amp\;cid=0e1475ff-8901-48a8-aeae-660a9e5b5547",nocase; classtype:attempted-recon; sid:200008397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixedgoat.com",nocase; http_uri; content:"/index.php",nocase; classtype:attempted-recon; sid:200008398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monovative-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/user_monovative_onmicrosoft_com/emczkjnkzgxdtejtstz67qqblknarn4da620kjaje91ewq?e=5:weseg8&amp\;at=9",nocase; classtype:attempted-recon; sid:200008399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morioka9.com",nocase; http_uri; content:"/sea/seanet.com.html",nocase; classtype:attempted-recon; sid:200008400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morioka9.com",nocase; http_uri; content:"/tus/optusnet.com.au.html",nocase; classtype:attempted-recon; sid:200008401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"most-afrikanist.co.za",nocase; http_uri; content:"/.system.info/chasetherednecktothesee.htm",nocase; classtype:attempted-recon; sid:200008402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mundovirtualhabbo.blogspot.com",nocase; http_uri; content:"/2009_01_01_archive.html",nocase; classtype:attempted-recon; sid:200008403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-btc-profit.com",nocase; http_uri; content:"/en?campaign_id=7pjhyyt6&external_click_id=e9871476-03e5-435f-b45b-ca7fa122ba2e&affname1=jamesonwells&net3=1111&reserv4=&reserv5=&aff_sub1=4ed792txirn3yd44&aff_sub2=&aff_sub3=&fbp=&ksget=1&tc=sms&analytics_session_id=d42ac036-668b-4f38-a21b-14651b15dc88&token=61656e1592a5414cfa24d388",nocase; classtype:attempted-recon; sid:200008404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/citizens-2021-grant/extra-pandemic-stimulus-bonus-application-citizens",nocase; classtype:attempted-recon; sid:200008405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/60d8ccf87e6c303b0f11e680",nocase; classtype:attempted-recon; sid:200008406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/60deff002ca34f5aa4985ab3",nocase; classtype:attempted-recon; sid:200008407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/6113e307a3f6e60d5120c56c",nocase; classtype:attempted-recon; sid:200008408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/615dc3d1144583702783c2c5",nocase; classtype:attempted-recon; sid:200008409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/617141d86b145458aa0ced80",nocase; classtype:attempted-recon; sid:200008410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/governmentstimulus1/stimulus",nocase; classtype:attempted-recon; sid:200008411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/mross3200/untitled-form",nocase; classtype:attempted-recon; sid:200008412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/robertnunn/pandemic-form",nocase; classtype:attempted-recon; sid:200008413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/uzhainedan/pandemicreliefprogramm",nocase; classtype:attempted-recon; sid:200008414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/verifikasi2/verifikasi-facebook",nocase; classtype:attempted-recon; sid:200008415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200008416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200008417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysait-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ebenezer_ajayi_edu_sait_ca/_layouts/15/wopiframe.aspx?guestaccesstoken=y%2bhr1dv9mxgpih7r4y%2f%2fjkhvv1nxdh3imaz%2bmjeumni%3d&docid=1_1ff1eb35301564d1698455e7de780fe7f&wdformid=%7b2b1e75ff%2d4748%2d448a%2db5f7%2d7d4a5138e7f7%7d&action=formsubmit&cid=b8bab67a-6675-4883-8c86-32942813ffb3",nocase; classtype:attempted-recon; sid:200008418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysummercamps.com",nocase; http_uri; content:"/forum/for_camp_directors_c3/research_and_learn_f10/bridging_the_gap_at_summer_camp/gforum.cgi?url=http://server.bludomain82.com/~bree2/review/#_&amp\;?hannah.judge@discsystems.co.uk",nocase; classtype:attempted-recon; sid:200008419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n9.cl",nocase; http_uri; content:"/fc8n7k94eavtmepu2w",nocase; classtype:attempted-recon; sid:200008420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nctods0plf.3642.gencmert.com",nocase; http_uri; content:"/.nctods0plf.ahr0chm6ly9hc3nlbnn1c29uzs5jb20vl05dde9euzbqteyvmtq2oduwotizl21py2hhzwwub3n0zmvszc8jbwljagflbc5vc3rmzwxkqhn0lmnvbq==",nocase; classtype:attempted-recon; sid:200008421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"necomimi.com",nocase; http_uri; content:"/n1.php",nocase; classtype:attempted-recon; sid:200008422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg140587-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/david_siteproperty_com/eq8kw97vmw9jkutctnkcbxkbmdwlprnakta1bywrks5-hw?e=vmna6v",nocase; classtype:attempted-recon; sid:200008423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg4219258-my.sharepoint.com",nocase; http_uri; content:"/personal/peter_baumanglobal_com/_layouts/15/authenticate.aspx",nocase; classtype:attempted-recon; sid:200008424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg5539223-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ddoris_airservicesco_com/_layouts/15/wopiframe.aspx?guestaccesstoken=%2b3y%2bcdfvdslxx0tgrivwrfjqapqcjfpi%2fnyhmijz6qa%3d&docid=1_1021e11db2d82413ebf54355221c28513&wdformid=%7b5bf1f9e2%2d5212%2d4414%2d8e87%2d9d18071fcce1%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200008426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7",nocase; classtype:attempted-recon; sid:200008427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?cid=09f38a51-5e01-4ed2-a663-a97e6a0de6bc",nocase; classtype:attempted-recon; sid:200008428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg791425-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/gscaglione_shulmanventures_com/esbu2b9nnzjagf5sh57gkkcbf8xzlqtnsdbogrc9uo_6-w?e=6kdxdd",nocase; classtype:attempted-recon; sid:200008429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft1393773-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/alan_etkinpllc_com/emv9ti9prk1ioco67l0q4eybqcu9jbj--dz3wlksvzg3lg?e=8ainmj",nocase; classtype:attempted-recon; sid:200008430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft2223515-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/leon_leongavartin_com/_layouts/15/wopiframe.aspx?guestaccesstoken=xamh1yie5ztbehymkwldcb6bkcf1kqp13dwjvauswg4%3d&docid=1_10f85e31d21194b00bc5c96bd48a6a4fc&wdformid=%7b702d2762%2df654%2d423b%2dba6b%2d850079f6ed46%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft7625533-my.sharepoint.com",nocase; http_uri; content:"/personal/service_grandisleties_com/_layouts/15/wopiframe.aspx?guestaccesstoken=pmxhjtsepwbmxi%20afreenyvyn0jrccvcgbqrd0jtcq8=&amp\;docid=1_1e318a834149c47f884752e9315da88d5&amp\;wdformid={21f3b38e-e8d9-4097-be99-0cb952413aff}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft7625533-my.sharepoint.com",nocase; http_uri; content:"/personal/service_grandisleties_com/_layouts/15/wopiframe.aspx?guestaccesstoken=pmxhjtsepwbmxi%2bafreenyvyn0jrccvcgbqrd0jtcq8%3d&docid=1_1e318a834149c47f884752e9315da88d5&wdformid=%7b21f3b38e%2de8d9%2d4097%2dbe99%2d0cb952413aff%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nevodevelopment.com",nocase; http_uri; content:"/wp-content/plugins/lmocrknhgl/wellsfargo/www.wellsfargo.com",nocase; classtype:attempted-recon; sid:200008434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nevodevelopment.com",nocase; http_uri; content:"/wp-content/plugins/lmocrknhgl/wellsfargo/www.wellsfargo.com/",nocase; classtype:attempted-recon; sid:200008435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;amp",nocase; classtype:attempted-recon; sid:200008436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;d34320f63d56ede7fd814ae4fb903952&amp\;dispatch=28eb2b0dad222b43ece5890ac6c4995f14fbf092",nocase; classtype:attempted-recon; sid:200008437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;dispatch=a747fec16e90d03372eec4b410a064f3315fc8ab",nocase; classtype:attempted-recon; sid:200008438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;e74cc56f728f08bf36fd1c917b4a5074&amp\;dispatch=a747fec16e90d03372eec4b410a064f3315fc8ab",nocase; classtype:attempted-recon; sid:200008439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nexoinmobiliario.pe",nocase; http_uri; content:"/bancos/interbank",nocase; classtype:attempted-recon; sid:200008440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nicosoft.com",nocase; http_uri; content:"/photos/phpupgrader/normal/?fmdvs={{email}}",nocase; classtype:attempted-recon; sid:200008441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihmt.com",nocase; http_uri; content:"/examination/admitpanel/filemanager/5365678587",nocase; classtype:attempted-recon; sid:200008442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nineled.com",nocase; http_uri; content:"/suncorp-user",nocase; classtype:attempted-recon; sid:200008443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nineled.com",nocase; http_uri; content:"/toolz/tescn/auth/login.php?action=login&amp\;account=7kfcpl7pmy84gyzgjr6lgqyke",nocase; classtype:attempted-recon; sid:200008444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nineled.com",nocase; http_uri; content:"/ujhgfw/tescn/auth/login.php?action=login&amp\;account=zmgf8c51tvuvounbnjfknp8yc",nocase; classtype:attempted-recon; sid:200008445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nortonknatchbull-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/19besoriob_nks_kent_sch_uk/eml51uxw3yblmb_cng_jobkbjiz5a9svhv-aa1dwwc9xqg?e=ufnvrz",nocase; classtype:attempted-recon; sid:200008446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"norwayposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200008447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nt.embluemail.com",nocase; http_uri; content:"/p/cl?data=3dzhsrhni9gfnm5yhfeluhcc3s9a2efgrjpc5=cr%2fj%2be08gapchysro05l7s3mgohtp8ditnifwrg68fk%2frmcugsx39wqz%2b1rpnasocds=ohsww%3d!-!:b3ei:!-!https%3a%2f%2f233nu.codesandbox.io?af=3dy2fizw5uzxr0mja=wnebvchr1c25ldc5jb20uyxu=3d",nocase; classtype:attempted-recon; sid:200008448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objectstorage.eu-frankfurt-1.oraclecloud.com",nocase; http_uri; content:"/n/frrkdpeqioed/b/gbilgilis-20211104-0040/o/thoiru.html/?email=geoff.segal@cerner.com",nocase; classtype:attempted-recon; sid:200008449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objectstorage.us-phoenix-1.oraclecloud.com",nocase; http_uri; content:"/n/axjt4zimmriy/b/cherishppps-20210930-1214/o/spaceblack.html",nocase; classtype:attempted-recon; sid:200008450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offredir.ru",nocase; http_uri; content:"/b458364051/",nocase; classtype:attempted-recon; sid:200008451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offredir.ru",nocase; http_uri; content:"/b577350977/",nocase; classtype:attempted-recon; sid:200008452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offredir.ru",nocase; http_uri; content:"/b996053497/",nocase; classtype:attempted-recon; sid:200008453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=!aiuszyywonlw6wq&amp\;cid=5a1faf0110c4a22c&amp\;id=5a1faf0110c4a22c!1550&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200008454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=!aiwjcwhmidrycfe&amp\;cid=6ff30ec047bf7f90&amp\;id=6ff30ec047bf7f90!1118&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200008455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21aef%2dmh1m1dxpwfq&amp\;cid=62e43ed1e02faa46&amp\;id=62e43ed1e02faa46%2145901&amp\;parid=62e43ed1e02faa46%218744&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200008456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21ag7v3k%5fv%5fvmx0wu&amp\;cid=2022b4d58b052264&amp\;id=2022b4d58b052264%21709&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200008457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21ahm9ud6tremilmy&amp\;cid=d3acf7db10258474&amp\;id=d3acf7db10258474%21118&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200008458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d91517ba717d8f93&amp\;resid=d91517ba717d8f93%21106&amp\;authkey=aad0mocflqj2d7g",nocase; classtype:attempted-recon; sid:200008459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/embed?cid=8c6ac597cdb8f3ca&amp\;resid=8c6ac597cdb8f3ca%216662&amp\;authkey=abbvyhcqvxnyk7a&amp\;em=2",nocase; classtype:attempted-recon; sid:200008460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=15d888f2c88e7d68%21104&amp\;authkey=%21alapi82fus8uhw8&amp\;page=view&amp\;wd=target%28martco.one%7c248982a3-c6db-4608-9b3f-59d46f4a8f11%2fdan%20shared%20a%20file%20with%20you%7c85b5e37c-8918-4d14-b5a0-0742bfe487b0%2f%29",nocase; classtype:attempted-recon; sid:200008461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=1b259cec1257165d%21143&authkey=%21apkdm5ellcpwz_w&page=view&wd=target%28quick%20notes.one%7c70d4ff33-5389-4385-b3e5-751c2cf1989e%2frau%20construction%7c961392e9-1ab5-4334-9d52-69d0f17f7c4c%2f%29",nocase; classtype:attempted-recon; sid:200008462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=7aa7bb4172c9678d%21104&authkey=%21ancnqdf2mi0o4bs&page=view&wd=target%28untitled%20section.one%7c78a1f9ff-7561-4169-a2f1-2b4bfce0e5d2%2fbusiness%20insurance%20services%2c%20inc.%7cb909bc92-cd18-491c-afbb-8e0537ffd3ed%2f%29",nocase; classtype:attempted-recon; sid:200008463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=a37258a5832f32b8%214551&authkey=%21ah-prmdnyc6z-he&page=view&wd=target%28quick%20notes.one%7c4617bc2b-8a69-4e83-9b28-fdc3f0e092a4%2freview%20document%20no.%20clt9071825%7ca63f7492-3a53-4740-8ff8-743d2bf58dd0%2f%29",nocase; classtype:attempted-recon; sid:200008464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=cc542b30a231222a%21104&authkey=%21aagyx6eylxtvs0i&page=view&wd=target%28southwest%20funding.one%7cdb02ff26-a000-4a11-a770-a766574c7395%2feric%20barefoot%c2%a0has%20shared%20a%20file%20with%20you%7cbbd45792-c84c-4ac7-b2f5-1368247a21f4%2f%29",nocase; classtype:attempted-recon; sid:200008465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=f950f8718f3413f!139&authkey=!abm4jclf3vh4_ea&ithint=file%2cxlsx&page=survey&wdformid=8786a7d4-f24e-494d-a981-ec4d7be22b99",nocase; classtype:attempted-recon; sid:200008466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=165bfee39105d588!1450&amp\;wdo=2&amp\;authkey=!ahdxqiyo1wxtypa",nocase; classtype:attempted-recon; sid:200008467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=2ccda0f55e51c04d!1056&amp\;authkey=!ahvxdmahsk9xqic",nocase; classtype:attempted-recon; sid:200008468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=63d34a02fb9cbdc0!830&amp\;ithint=onenote%2c&amp\;wdo=2&amp\;authkey=!agdcipgpa9o5uw8",nocase; classtype:attempted-recon; sid:200008469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=b116b3793040630b!5852&amp\;ithint=onenote%2c&amp\;authkey=!altmjf-4bzb1ygu",nocase; classtype:attempted-recon; sid:200008470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=b730f58852aff932!139&amp\;ithint=onenote%2c&amp\;wdo=2&amp\;authkey=!aul7udqhfptgafm",nocase; classtype:attempted-recon; sid:200008471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-admin/user/post/postmaster/login.php",nocase; classtype:attempted-recon; sid:200008472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../?i=i&amp\;0=ask@fido.dk",nocase; classtype:attempted-recon; sid:200008473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../?i=i&amp\;0=contact@sceneworld.org",nocase; classtype:attempted-recon; sid:200008474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php",nocase; classtype:attempted-recon; sid:200008475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=aw5mb3jtyxrpb25azm9ydglzbg9nawmuy29t&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=aw5mb3jtyxrpb25azm9ydglzbg9nawmuy29t&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc'",nocase; classtype:attempted-recon; sid:200008477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=axruqhzlzwftlmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=ci1jbhviqhjsym9vzs5hda==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=skn1bgxlbkbpbnryywxpbmtzlmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=y2hyaw1pbguxqhbyywrhbmv3c3r5bguuy29t&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../load.php?0=ywjjqgfiyy5jb20=&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../v4hwim6nagqleq7bqju517u2ro.php?0=aw5mb3jtyxrpb25azm9ydglzbg9nawmuy29t&.verify??guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5encxtci3e56k0vz3psl6poiodvee6vv6vaibzqdjcyabahdiaf7gx2w9xrgmch4orbe2vczo9an_",nocase; classtype:attempted-recon; sid:200008483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-content/.../y5xa4tcp8cqyakc9mxm2kjgpro.php?0=ci1jbhviqhjsym9vzs5hda==&.verify??guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5encxtci3e56k0vz3psl6poiodvee6vv6vaibzqdjcyabahdiaf7gx2w9xrgmch4orbe2vczo9an_",nocase; classtype:attempted-recon; sid:200008484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-includes/.../?i=i&amp\;0=ask@fido.dk",nocase; classtype:attempted-recon; sid:200008485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-includes/.../load.php",nocase; classtype:attempted-recon; sid:200008486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-includes/.../load.php?0=&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-includes/.../load.php?0=ymjly2tadxnszwdlbmrjyxjzlmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auction-review.com",nocase; http_uri; content:"/wp-includes/.../load.php?0=ynrlcnj5qhnlcnzpy2vtyw5hz2vtzw50lmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200008489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-spkprivat.com",nocase; http_uri; content:"/rvcipew2pj",nocase; classtype:attempted-recon; sid:200008490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/dssmibyk/789c19c6-58f7-4a39-8cf3-62e4f13c605a",nocase; classtype:attempted-recon; sid:200008491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/dxhotnbj/aad0ff1e-c90d-487c-a28d-f07b0d303e5c",nocase; classtype:attempted-recon; sid:200008492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/jqliidcl/29c78a95-ff7d-42a0-9cef-43118693b879",nocase; classtype:attempted-recon; sid:200008493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/lvswydoz/f4123832-7b09-4ac6-bbfc-9fde28e728c4",nocase; classtype:attempted-recon; sid:200008494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e",nocase; classtype:attempted-recon; sid:200008495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineaccessplus.com",nocase; http_uri; content:"/tdbank/",nocase; classtype:attempted-recon; sid:200008496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinehalifax-account.com",nocase; http_uri; content:"/halifax",nocase; classtype:attempted-recon; sid:200008497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinehalifax-account.com",nocase; http_uri; content:"/halifax/login.php",nocase; classtype:attempted-recon; sid:200008498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opsxpert.com",nocase; http_uri; content:"/all/ppp/?login=sudha@bentonbiz.com",nocase; classtype:attempted-recon; sid:200008499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200008500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oraclemart.com",nocase; http_uri; content:"/ondedrive/onedrive/rolex/index.php",nocase; classtype:attempted-recon; sid:200008501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orsted-refund.blogspot.com",nocase; http_uri; content:"/2021/08/rsted.html",nocase; classtype:attempted-recon; sid:200008502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc",nocase; classtype:attempted-recon; sid:200008503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=4a49409f-2030-2000-55c3-0f6b60771e27&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9ylp0ujd2tewxmgc&amp\;cid=18ed1537-8fab-4a88-9a51-f62af2ba3e85",nocase; classtype:attempted-recon; sid:200008504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=7448409f-907f-2000-55b9-8b3856a492d0&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9bjdxazvqrewxmgc&amp\;cid=17aea50f-0cad-4a24-8ca6-2b3aba94e944",nocase; classtype:attempted-recon; sid:200008505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=e3083d9f-70d3-2000-e93a-b2a109d8122f&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9mnjsznrbteuxmgc&amp\;cid=ce3f6183-644d-4c2c-b9c5-e59d8ec48d03",nocase; classtype:attempted-recon; sid:200008506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=e5083d9f-a047-2000-523d-f23a7ab7042b&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9tvlqc3r3teuxmgc&amp\;cid=06a207b4-652a-4300-9385-5d89a890e4fe",nocase; classtype:attempted-recon; sid:200008507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ow.ly",nocase; http_uri; content:"/lcqx30cdfcg",nocase; classtype:attempted-recon; sid:200008508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200008509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200008510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200008511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200008512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200008513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200008514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200008515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200008516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'/",nocase; classtype:attempted-recon; sid:200008517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"padlet-uploads.storage.googleapis.com",nocase; http_uri; content:"/610964646/d0a82b340ac6b4eb2fed334399fe2e84/palad.html",nocase; classtype:attempted-recon; sid:200008518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paozeia.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200008519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parg.co",nocase; http_uri; content:"/bred",nocase; classtype:attempted-recon; sid:200008520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parmacityschooldistrict-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rosee_parmacityschools_org/_layouts/15/wopiframe.aspx?guestaccesstoken=amgmrypee2b3%2fq5mcsf%2bmqat2vaamt9idaj1njxwdpe%3d&amp\;docid=1_1514e14043e894d289ec8998e5536118b&amp\;wdformid=%7beb853daf%2d5ba6%2d40dd%2dbf99%2d970f5cf41327%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parnamg.info",nocase; http_uri; content:"/index.php",nocase; classtype:attempted-recon; sid:200008522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/25qk2",nocase; classtype:attempted-recon; sid:200008523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26c30",nocase; classtype:attempted-recon; sid:200008524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26dcc",nocase; classtype:attempted-recon; sid:200008525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26e8w",nocase; classtype:attempted-recon; sid:200008526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/278zi",nocase; classtype:attempted-recon; sid:200008527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/27tk1",nocase; classtype:attempted-recon; sid:200008528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2884c",nocase; classtype:attempted-recon; sid:200008529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/28eek",nocase; classtype:attempted-recon; sid:200008530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2980b",nocase; classtype:attempted-recon; sid:200008531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29igl",nocase; classtype:attempted-recon; sid:200008532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29jzn",nocase; classtype:attempted-recon; sid:200008533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29n5y",nocase; classtype:attempted-recon; sid:200008534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29vnj",nocase; classtype:attempted-recon; sid:200008535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2a9kr",nocase; classtype:attempted-recon; sid:200008536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9m",nocase; classtype:attempted-recon; sid:200008537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9x",nocase; classtype:attempted-recon; sid:200008538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2amyg",nocase; classtype:attempted-recon; sid:200008539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2btlc",nocase; classtype:attempted-recon; sid:200008540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2bxht",nocase; classtype:attempted-recon; sid:200008541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c1g8",nocase; classtype:attempted-recon; sid:200008542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c396",nocase; classtype:attempted-recon; sid:200008543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrickkestens-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/patrick_kestens_kepa_be/ek6ptmfi3rbpl0okvukyovobz5voxh1dgbqr66js29e06w?e=zytfn9",nocase; classtype:attempted-recon; sid:200008544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrickkestens-my.sharepoint.com",nocase; http_uri; content:"/personal/patrick_kestens_kepa_be/_layouts/15/doc.aspx?sourcedoc={c74ca94e-dee2-4fb0-9743-a4bd4932395a}&amp\;action=default&amp\;slrid=53537f9f-8020-2000-6402-9094cd7180b6&amp\;originalpath=ahr0chm6ly9wyxryawnra2vzdgvucy1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9wyxryawnrx2tlc3rlbnnfa2vwyv9izs9fazzwve1matnyqlbsme9rdlvreu9wb0janvzvwggxredicvi2nkptmjllmdz3p3j0aw1lpun2vwfidhbsmkvn&amp\;cid=3dd22632-4961-431e-befd-a875d08cde81",nocase; classtype:attempted-recon; sid:200008545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-inc-userupdatenuber7925570844.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200008546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-my.sharepoint.com",nocase; http_uri; content:"/personal/keyu_paypal_com/documents/delivering%20certainty%20presentation/delivering%20certainty%20roadmap%20presentation%204.18.19%20v11%20(shared).pptx",nocase; classtype:attempted-recon; sid:200008547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-myacount.com",nocase; http_uri; content:"/check.php",nocase; classtype:attempted-recon; sid:200008548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-myacount.com",nocase; http_uri; content:"/code.html",nocase; classtype:attempted-recon; sid:200008549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-myacount.com",nocase; http_uri; content:"/email.php",nocase; classtype:attempted-recon; sid:200008550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-myacount.com",nocase; http_uri; content:"/phone.php",nocase; classtype:attempted-recon; sid:200008551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalvsgooglecheckout.com",nocase; http_uri; content:"/countries",nocase; classtype:attempted-recon; sid:200008552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalvsgooglecheckout.com",nocase; http_uri; content:"/countries/",nocase; classtype:attempted-recon; sid:200008553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbox.photobox.co.uk",nocase; http_uri; content:"/dynclick/photobox-uk/?eml-publisher=photobox-uk&amp\;eml-name=phx_t_uk_new_crn_e2_bau_all&amp\;uid=67912768&amp\;eurl=http://photobox-mkt-prod1-t.campaign.adobe.com/r/?id=h4e5ec0b9,69a17086,5eb6e68f&amp\;utm_source=photobox&amp\;utm_medium=email&amp\;utm_campaign=t_all_w26_20200623_uk_crn_tips-and-trading-plan_2_bau_ac1982206_web_1772187782&amp\;_c1v=crm&amp\;_c2v=trigger&amp\;_c3v=creation&amp\;_c4id=1982206&amp\;_c5id=1772187782&amp\;_c6id=all&amp\;_c7id=acc&amp\;_cdt=2020-06-23&amp\;_ceh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;_cleh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;p1=ak-x.shop/?e=zg91z2xhc0btewnvbxbhbnltywdhemluzs5jb20=%23/my/creations",nocase; classtype:attempted-recon; sid:200008554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pepsicola1-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rmutyaba_pepsi-cola_co_ug/_layouts/15/wopiframe.aspx?guestaccesstoken=q1xrx9cq6omueu0gw5ech36jcmrq7yl45zuzcxjws54%3d&amp\;docid=1_182d7ec9b7ef240e7b33e879a44314f92&amp\;wdformid=%7b0692719f%2d1981%2d4f26%2db7cd%2da0e252746cb1%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peru-retail.com",nocase; http_uri; content:"/?adid=104597&amp%3burl=https%3a%2f%2fpago-correos-camino.com%2fpostnord%2f",nocase; classtype:attempted-recon; sid:200008556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pesc.pw",nocase; http_uri; content:"/amazon-jp",nocase; classtype:attempted-recon; sid:200008557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phynxzit.com",nocase; http_uri; content:"/covidapprove/attachment%20name%2020210312_2049.pdf.html",nocase; classtype:attempted-recon; sid:200008558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pilgrimapp.com",nocase; http_uri; content:"/wp-mails/",nocase; classtype:attempted-recon; sid:200008559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/css/login.htm?email=&amp\;email&amp\;",nocase; classtype:attempted-recon; sid:200008560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html",nocase; classtype:attempted-recon; sid:200008561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;flag=isle&amp\;tracelog=edmfooter&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notification20160310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notificationtips2016310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_privacy&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_term&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?url_type=header_homepage&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200008567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plaqexit.com",nocase; http_uri; content:"/?a=1115&amp\;oc=14120&amp\;c=39893&amp\;m=3&amp\;s1=&amp\;ckmguid=bf41e6a2-6b7f-4086-ac5b-41fef30afee6",nocase; classtype:attempted-recon; sid:200008568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/pasi_puumalainen_plytec_fi/eviubi-o5_rgorvtg1ptinyb5th9mqv-2ev_l8ujkorojg?e=5%3a8603ib&at=9",nocase; classtype:attempted-recon; sid:200008569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/personal/pasi_puumalainen_plytec_fi/_layouts/15/wopiframe.aspx?sourcedoc={8f0414f2-e7a8-46f4-a2bb-d38353ed20d6}&amp\;action=default&amp\;originalpath=ahr0chm6ly9wbhl0zwnmas1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9wyxnpx3b1dw1hbgfpbmvux3bsexrly19mas9fdklvqkktbzvfukdvcnzuzzfqdelowui1vgg5bxf2ltjlvl9mohvka09sb2pnp3j0aw1lpxvysjgtvnb2mtbn",nocase; classtype:attempted-recon; sid:200008570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; http_uri; content:"/archives/%3c17bb1b72.aa4aabambdsaachbnjiaaagn5iaaaaaajbganduyabbhkabgnaaw%40mailjet.com%3e%7cxntjjt7d%2bpgxnycpm8zjag%3d%3d",nocase; classtype:attempted-recon; sid:200008571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/28221802",nocase; classtype:attempted-recon; sid:200008572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/28221802#page",nocase; classtype:attempted-recon; sid:200008573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/29149732#page",nocase; classtype:attempted-recon; sid:200008574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/29291212#page",nocase; classtype:attempted-recon; sid:200008575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=1rt3s",nocase; classtype:attempted-recon; sid:200008576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=4j21b",nocase; classtype:attempted-recon; sid:200008577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_2",nocase; classtype:attempted-recon; sid:200008578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_20",nocase; classtype:attempted-recon; sid:200008579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_9",nocase; classtype:attempted-recon; sid:200008580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-uk",nocase; classtype:attempted-recon; sid:200008581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband_1",nocase; classtype:attempted-recon; sid:200008582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broardband-services",nocase; classtype:attempted-recon; sid:200008583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=diaa0",nocase; classtype:attempted-recon; sid:200008584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=hiatb",nocase; classtype:attempted-recon; sid:200008585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=what-is-the-usage-policy-for-bt-email_2",nocase; classtype:attempted-recon; sid:200008586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=x5wo8",nocase; classtype:attempted-recon; sid:200008587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=xnvq4",nocase; classtype:attempted-recon; sid:200008588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect2.fireeye.com",nocase; http_uri; content:"/url?k=1d4614ec17334d4a.1d465a2d-45b66b5f372e82c4&amp\;u=http://www.standrew.co.kr/bluead/editor/uploaded/img/caslog1/cas.auth.sc.edu/uofsc.html",nocase; classtype:attempted-recon; sid:200008589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proxima-net.com",nocase; http_uri; content:"/0193/webscr",nocase; classtype:attempted-recon; sid:200008590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proxima-net.com",nocase; http_uri; content:"/0193/webscr/",nocase; classtype:attempted-recon; sid:200008591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pse.is",nocase; http_uri; content:"/amazon_co_jp",nocase; classtype:attempted-recon; sid:200008592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pub43.bravenet.com",nocase; http_uri; content:"/emailfwd/show.php?usernum=3669541711&amp\;formid=3811",nocase; classtype:attempted-recon; sid:200008593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pub5.bravenet.com",nocase; http_uri; content:"/emailfwd/show.php?usernum=350311855&amp\;formid=3879",nocase; classtype:attempted-recon; sid:200008594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/eg8osty0",nocase; classtype:attempted-recon; sid:200008595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/eg8osty0/",nocase; classtype:attempted-recon; sid:200008596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/pfbgzhkd",nocase; classtype:attempted-recon; sid:200008597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/umjjyvmr",nocase; classtype:attempted-recon; sid:200008598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/vn79myoi",nocase; classtype:attempted-recon; sid:200008599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; http_uri; content:"/0/?i=i&amp\;0=info@google.com",nocase; classtype:attempted-recon; sid:200008600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200008601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200008602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200008603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200008604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200008605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200008606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200008607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200008608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200008609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200008610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qu28t0z4cq.sembolin0sgrachatcredit.com",nocase; http_uri; content:"/rd/c507beqag1244882wfxm52879flr7387rpqq181",nocase; classtype:attempted-recon; sid:200008611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw ncgnemfdqjrmoajqkuc9c41sq13edqfoeu=&amp\;docid=1_16dc35173dd06466fa8c37e332833f0bd&amp\;wdformid={67d0feef-08d4-4d0a-8a25-0d2c9b0a2eed}/&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200008613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%3e%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200008614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quip.com",nocase; http_uri; content:"/qv7malu8n7cz/you-have-some-messages-pending",nocase; classtype:attempted-recon; sid:200008616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qwalletconnect.com",nocase; http_uri; content:"/#",nocase; classtype:attempted-recon; sid:200008617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.smore.com",nocase; http_uri; content:"/c?u=https://yanamholidays.com/b00-b26n5-82m-c04b-o84v-13h-e66-t38e-c90?m5=eric.stockland@iextrading.com",nocase; classtype:attempted-recon; sid:200008618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.ddlnk.net",nocase; http_uri; content:"/72qr-2jru-1v0pvl-21gx4-1/c.aspx",nocase; classtype:attempted-recon; sid:200008619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.ddlnk.net",nocase; http_uri; content:"/t/74eu-2qf5-1x3ufn-27p2j-1/c.aspx",nocase; classtype:attempted-recon; sid:200008620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.ddlnk.net",nocase; http_uri; content:"/t/74j8-2qyw-1x70ta-286li-1/c.aspx",nocase; classtype:attempted-recon; sid:200008621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.ddlnk.net",nocase; http_uri; content:"/t/74o1-2rf4-1xbgh3-28nol-1/c.aspx",nocase; classtype:attempted-recon; sid:200008622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.dotdigital-pages.com",nocase; http_uri; content:"/p/74kv-45k",nocase; classtype:attempted-recon; sid:200008623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r3g34.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/77ll23ween.html",nocase; classtype:attempted-recon; sid:200008624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05",nocase; classtype:attempted-recon; sid:200008625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05?m=1",nocase; classtype:attempted-recon; sid:200008626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020?m=1",nocase; classtype:attempted-recon; sid:200008627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakteun.tszxjt.com",nocase; http_uri; content:"/member/pc.html",nocase; classtype:attempted-recon; sid:200008628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakteun.tszxjt.com",nocase; http_uri; content:"/member/wap.html",nocase; classtype:attempted-recon; sid:200008629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rb.gy",nocase; http_uri; content:"/pj3dr2",nocase; classtype:attempted-recon; sid:200008630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; http_uri; content:"/geo/dk/eur/register/5k/index_auth.php",nocase; classtype:attempted-recon; sid:200008631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; http_uri; content:"/geo/en/usd/register/5/index_auth.php",nocase; classtype:attempted-recon; sid:200008632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; http_uri; content:"/geo/es/usd/registro/5/index_auth.php",nocase; classtype:attempted-recon; sid:200008633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; http_uri; content:"/geo/fr/eur/inscription/5/index_auth.php",nocase; classtype:attempted-recon; sid:200008634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; http_uri; content:"/geo/no/eur/register/5k/index_auth.php",nocase; classtype:attempted-recon; sid:200008635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reamaam.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200008636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/30rnfx1",nocase; classtype:attempted-recon; sid:200008637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/3ads20",nocase; classtype:attempted-recon; sid:200008638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/4yc7w4o",nocase; classtype:attempted-recon; sid:200008639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/668b5",nocase; classtype:attempted-recon; sid:200008640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/8k8kt",nocase; classtype:attempted-recon; sid:200008641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/96s871",nocase; classtype:attempted-recon; sid:200008642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/a7n4y3x",nocase; classtype:attempted-recon; sid:200008643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/ahcz51u",nocase; classtype:attempted-recon; sid:200008644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/okywxzj",nocase; classtype:attempted-recon; sid:200008645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/w1lrupp",nocase; classtype:attempted-recon; sid:200008646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/wjqi04k",nocase; classtype:attempted-recon; sid:200008647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/z83ig2n?rb.routing.mode=proxy&amp\;rb.routing.signature=123 836",nocase; classtype:attempted-recon; sid:200008648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zikqv8f?email=eimaste@stinpriza.org&amp\;domain=stinpriza.orgwebapp*",nocase; classtype:attempted-recon; sid:200008649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zitln6v",nocase; classtype:attempted-recon; sid:200008650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.viglink.com",nocase; http_uri; content:"/?ed&amp\;key=fd5de1d096b38be9fffd6ddc1948df4f&amp\;u=%61%70%69%2e%61%64%64%74%68%69%73%2e%63%6f%6d%2f%6f%65%78%63%68%61%6e%67%65%2f%30%2e%38%2f%77%72%61%70%2f%6f%70%65%6e%67%72%61%70%68%e2%80%8c%75%72%6c%3dahr0chm6ly9ua3yuchvil3h5nt9sdwvlchpyanvtegtvdnpjzxhqehn2dgdnzm5hbhntewp3bwtwdnb0cxl2awvozxnjewnvdxvkywzkcm9za2tqamviyxpnjmfsdd1tzwrpysnkmlzpyldgemrhvnlrr04xym1rdvkzbz0=",nocase; classtype:attempted-recon; sid:200008651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.voici-news.fr",nocase; http_uri; content:"/p-351075-95303b56fd8597a1946dc433811ae477-239262-78/?cl=1&amp\;n=39&amp\;l=o&amp\;u=https%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj%26q%3d%26esrc%3ds%26source%3dweb%26cd%3d%26cad%3drja%26uact%3d8%26ved%3d2ahukewiz1pcljixqahweoxekhqkhbggqfjacegqiarab%26url%3dhttps%253a%252f%252fwww.lab4rent.it%252fofferte%252fhonda-sh-150-abs-bauletto-e-parabrezza%252f%26usg%3daovvaw0uufychhtdy_ozq1pxdtip",nocase; classtype:attempted-recon; sid:200008652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redlinerecruitment353-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/beverley_latham_redlinerecruitment_com/elyngikq5ufbqvwgcsqwtt4b1njgntt_lj45lr_y-735iw?e=5%3ajitv78&amp\;at=9",nocase; classtype:attempted-recon; sid:200008653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redlinerecruitment353-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/beverley_latham_redlinerecruitment_com/elyngikq5ufbqvwgcsqwtt4b1njgntt_lj45lr_y-735iw?e=5:jitv78&amp\;at=9",nocase; classtype:attempted-recon; sid:200008654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/1xrr1y",nocase; classtype:attempted-recon; sid:200008655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/brkoqe",nocase; classtype:attempted-recon; sid:200008656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/dvk4gd",nocase; classtype:attempted-recon; sid:200008657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/gvjolp?co=muj3e",nocase; classtype:attempted-recon; sid:200008658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/jdegy2",nocase; classtype:attempted-recon; sid:200008659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/oleeqj",nocase; classtype:attempted-recon; sid:200008660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/qd7na2",nocase; classtype:attempted-recon; sid:200008661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/xeknoz?confirmation",nocase; classtype:attempted-recon; sid:200008662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/xgmxr1",nocase; classtype:attempted-recon; sid:200008663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinodriedfruit.co.za",nocase; http_uri; content:"/xwixwixwixwi",nocase; classtype:attempted-recon; sid:200008664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinodriedfruit.co.za",nocase; http_uri; content:"/xwixwixwixwi/",nocase; classtype:attempted-recon; sid:200008665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riderctposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200008666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmact-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/srichlin_rmact_com/_layouts/15/wopiframe.aspx?guestaccesstoken=492wqqtzlbznzq7qdpemrme%2bi%2bhghqqnqlo250fbc9i%3d&docid=1_10c4e2ffbd9ec47cbbc6f0253baa7b64d&wdformid=%7b914c12ed%2d68e0%2d4419%2db8b0%2ded5f7e09de29%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rnd.pushwoosh.com",nocase; http_uri; content:"/json/1.3/emailredirect?application=d2416-0c590&e=yassinmepo%40yahoo.com&link=ahr0chm6ly93d3cuaw5zdgfncmftlmnvbs9ybmquzguvp2hspwrl&n=ciagicagicagicagicagicagicagicagicagicagicagicagidxpbwcgy2xhc3m9im5slwzvb3rlcl9fc29jawfslw1lzglhlwljb24iihnyyz0iahr0chm6ly9zmy5lds1jzw50cmfslteuyw1hem9uyxdzlmnvbs9zdgf0awmucm5klmrll3nvy2lhbc1tzwrpys1mb290zxivaw5zdgfncmftqdj4lnbuzyigywx0psjjbnn0ywdyyw0iihdpzhropsizmsigagvpz2h0psizmsigc3r5bgu9ii1tcy1pbnrlcnbvbgf0aw9ulw1vzgu6igjpy3viawm7igjvcmrlcjogbm9uztsgagvpz2h0oiazmxb4oybsaw5llwhlawdoddogmtawjtsgb3v0bgluztogbm9uztsgdgv4dc1kzwnvcmf0aw9uoibub25loyb3awr0adogmzfwedsipgogicagicagicagicagicagicagicagicagicagicagia%3d%3d&o=ahr0chm6ly93d3cuaw5zdgfncmftlmnvbs9ybmquzguvp2hspwrl&t=88ef3-29d91&hash=%2cdu",nocase; classtype:attempted-recon; sid:200008668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roldanlogistica2-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/comercial1_rolcoshipping_com1/eruuxky76yxlk7vzdfzrfzybicm0kmv7-914pwcpo9g4mq?e=ppogt",nocase; classtype:attempted-recon; sid:200008669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronigelo.blogspot.com",nocase; http_uri; content:"/2020/10/roni-gelo.html",nocase; classtype:attempted-recon; sid:200008670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet.page",nocase; http_uri; content:"/verify/",nocase; classtype:attempted-recon; sid:200008671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotf.lol",nocase; http_uri; content:"/verifikasifacebook",nocase; classtype:attempted-recon; sid:200008672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roxburycommunitycolleg798-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/g/personal/enebelitsky_rcc_mass_edu/er4mnitiqezdprvsiljksn4bexpjqkfwl8c3bunhudv4ww?e=4%3a2anva6&at=9",nocase; classtype:attempted-recon; sid:200008673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200008674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200008675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200008676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200008677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200008678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt.gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200008679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsfsavingsandtrust.com",nocase; http_uri; content:"/csin.html",nocase; classtype:attempted-recon; sid:200008680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/2019conta",nocase; classtype:attempted-recon; sid:200008681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/amex-homemerchant",nocase; classtype:attempted-recon; sid:200008682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/aoeje",nocase; classtype:attempted-recon; sid:200008683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/appcefativa",nocase; classtype:attempted-recon; sid:200008684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/aw12n",nocase; classtype:attempted-recon; sid:200008685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/b-6ni",nocase; classtype:attempted-recon; sid:200008686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/blessedhotega",nocase; classtype:attempted-recon; sid:200008687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/bnk2n",nocase; classtype:attempted-recon; sid:200008688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/brueh",nocase; classtype:attempted-recon; sid:200008689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/canceleagora1",nocase; classtype:attempted-recon; sid:200008690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ck48o",nocase; classtype:attempted-recon; sid:200008691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/cnivi",nocase; classtype:attempted-recon; sid:200008692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/cx6bz",nocase; classtype:attempted-recon; sid:200008693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/cxcancela",nocase; classtype:attempted-recon; sid:200008694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/d4pyp/",nocase; classtype:attempted-recon; sid:200008695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/debitocancelado1",nocase; classtype:attempted-recon; sid:200008696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/debitocancelado1/",nocase; classtype:attempted-recon; sid:200008697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/eelog",nocase; classtype:attempted-recon; sid:200008698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fb_login",nocase; classtype:attempted-recon; sid:200008699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fhzgr",nocase; classtype:attempted-recon; sid:200008700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fx9xc",nocase; classtype:attempted-recon; sid:200008701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/geiqo",nocase; classtype:attempted-recon; sid:200008702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/gi3wg",nocase; classtype:attempted-recon; sid:200008703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/gi3zf",nocase; classtype:attempted-recon; sid:200008704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/hghg2",nocase; classtype:attempted-recon; sid:200008705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/hnjzi/",nocase; classtype:attempted-recon; sid:200008706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ing-update",nocase; classtype:attempted-recon; sid:200008707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/iusan",nocase; classtype:attempted-recon; sid:200008708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/kerosine8",nocase; classtype:attempted-recon; sid:200008709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/kpkkpkkpk",nocase; classtype:attempted-recon; sid:200008710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/login-fb",nocase; classtype:attempted-recon; sid:200008711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/login-fb?",nocase; classtype:attempted-recon; sid:200008712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/onlnedesk",nocase; classtype:attempted-recon; sid:200008713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/pai-scefsegted",nocase; classtype:attempted-recon; sid:200008714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/peringatan-fb",nocase; classtype:attempted-recon; sid:200008715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/roadrun3",nocase; classtype:attempted-recon; sid:200008716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/sisebseguranca",nocase; classtype:attempted-recon; sid:200008717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/sparka-de",nocase; classtype:attempted-recon; sid:200008718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/super-cocovnla/",nocase; classtype:attempted-recon; sid:200008719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/verzend-heffing",nocase; classtype:attempted-recon; sid:200008720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/woning",nocase; classtype:attempted-recon; sid:200008721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/woning-web",nocase; classtype:attempted-recon; sid:200008722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/wpyih",nocase; classtype:attempted-recon; sid:200008723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/xzod5",nocase; classtype:attempted-recon; sid:200008724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yqnun",nocase; classtype:attempted-recon; sid:200008725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ytk-r",nocase; classtype:attempted-recon; sid:200008726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yw5o-",nocase; classtype:attempted-recon; sid:200008727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yz3zs",nocase; classtype:attempted-recon; sid:200008728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/zrg9b",nocase; classtype:attempted-recon; sid:200008729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.amazonaws.com",nocase; http_uri; content:"/progressivebank-uat/index.html",nocase; classtype:attempted-recon; sid:200008730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.ap-northeast-1.amazonaws.com",nocase; http_uri; content:"/share-point863279.79823acesss8637doc7329831210file8732.com/index%20(11).html?dg=pkulkarni@zogenix.com",nocase; classtype:attempted-recon; sid:200008731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200008732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandert12.blogspot.com",nocase; http_uri; content:"/p/la-banque-postale.html",nocase; classtype:attempted-recon; sid:200008733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjoaquinvalleybrewfest.com",nocase; http_uri; content:"/backup/wp-content/plugins/dude/configuration/themes/mak/index.php?email=&amp\;amp",nocase; classtype:attempted-recon; sid:200008734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjoaquinvalleybrewfest.com",nocase; http_uri; content:"/backup/wp-content/plugins/dude/configuration/themes/mak/index.php?email=contact@ironscales.com&amp\;id=432526cfdsd6567656dgvdhytdfbhjgff4536365353",nocase; classtype:attempted-recon; sid:200008735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sateegourmet.com",nocase; http_uri; content:"/sbot",nocase; classtype:attempted-recon; sid:200008736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"script.google.com",nocase; http_uri; content:"/macros/s/akfycbwc6y7yuxmti0kr8e5d3m62ucmsuhkihk-zzxby7xngxeopneyy/exec",nocase; classtype:attempted-recon; sid:200008737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-online-payeemagement.com",nocase; http_uri; content:"/halifax",nocase; classtype:attempted-recon; sid:200008738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-online-payeemagement.com",nocase; http_uri; content:"/halifax/login.php",nocase; classtype:attempted-recon; sid:200008739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sehzademarket.com",nocase; http_uri; content:"/nmj.php",nocase; classtype:attempted-recon; sid:200008740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seonewsservic.blogspot.com",nocase; http_uri; content:"/p/postenno_9.html",nocase; classtype:attempted-recon; sid:200008741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicefacture.blogspot.com",nocase; http_uri; content:"/2020/04/blog-post_10.html",nocase; classtype:attempted-recon; sid:200008742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.hsforms.com",nocase; http_uri; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d",nocase; classtype:attempted-recon; sid:200008743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.hsforms.com",nocase; http_uri; content:"/1owoqghkbqdo-dfbltgexeq4g63f",nocase; classtype:attempted-recon; sid:200008744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shared-document.com",nocase; http_uri; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d",nocase; classtype:attempted-recon; sid:200008745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharpolnt.com",nocase; http_uri; content:"/ga46btm2gbagkylw",nocase; classtype:attempted-recon; sid:200008746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sho.cat",nocase; http_uri; content:"/xc",nocase; classtype:attempted-recon; sid:200008747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shorturl.at",nocase; http_uri; content:"/nqgu1",nocase; classtype:attempted-recon; sid:200008748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shorturl.at",nocase; http_uri; content:"/pdlp9",nocase; classtype:attempted-recon; sid:200008749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shoutout.wix.com",nocase; http_uri; content:"/so/29nxdzhlu/c?w=6cqhoe6cvp5sgmmsaghxgp5ym3iyanqygauqwdhnqmi.eyj1ijoiahr0chm6ly93yxrhc2lpcmpyawjoys5ibg9ilmnvcmuud2luzg93cy5uzxqvdgvzdgluzy9tcgxuynzjegrmlmh0bwwilcjyijoinzewowuwzgitnjy5mi00ngrhltuzm2qtnjaynzk1zje0ymuxiiwibsi6im1hawwilcjjijoimdawmdawmdatmdawmc0wmdawltawmdatmdawmdawmdawmdawin0#qs=r-agikbadkfkgdhdjaehfdidgafgccdigaehkkdaehkkdababaibadccaccaccjhackcjaibjfhacb",nocase; classtype:attempted-recon; sid:200008750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shrunken.com",nocase; http_uri; content:"/url_redirector.php?url=a6yt8",nocase; classtype:attempted-recon; sid:200008751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=1",nocase; classtype:attempted-recon; sid:200008752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=2",nocase; classtype:attempted-recon; sid:200008753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/3cd35d",nocase; classtype:attempted-recon; sid:200008754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/h45c89",nocase; classtype:attempted-recon; sid:200008755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/hqtfwb",nocase; classtype:attempted-recon; sid:200008756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jwj7gr",nocase; classtype:attempted-recon; sid:200008757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jylrtp",nocase; classtype:attempted-recon; sid:200008758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/wlgtvw",nocase; classtype:attempted-recon; sid:200008759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200008760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitcsurkhet.com.np",nocase; http_uri; content:"/img/online/session/reset_account.php",nocase; classtype:attempted-recon; sid:200008761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/a/esemman.web.app/casdfgtyasda/-pdf-58",nocase; classtype:attempted-recon; sid:200008762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/a/sy4norton.com/setup/home",nocase; classtype:attempted-recon; sid:200008763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/grossohooperlaw.com/grossohooperlaw/home",nocase; classtype:attempted-recon; sid:200008764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/buayomuarobtp/",nocase; classtype:attempted-recon; sid:200008765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/cilakourangma/",nocase; classtype:attempted-recon; sid:200008766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/clamingidentify008754501/",nocase; classtype:attempted-recon; sid:200008767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/confrimationsacounst/home",nocase; classtype:attempted-recon; sid:200008768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/e9d24c72/23524457",nocase; classtype:attempted-recon; sid:200008769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis",nocase; classtype:attempted-recon; sid:200008770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis/assignments",nocase; classtype:attempted-recon; sid:200008771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/help74540110104104014100/",nocase; classtype:attempted-recon; sid:200008772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve",nocase; classtype:attempted-recon; sid:200008773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve/",nocase; classtype:attempted-recon; sid:200008774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/maxsecureacc564988/",nocase; classtype:attempted-recon; sid:200008775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/policyclaming99008767/",nocase; classtype:attempted-recon; sid:200008776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/protectedinmprovmnt44/",nocase; classtype:attempted-recon; sid:200008777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/safetycheck427064200647221/",nocase; classtype:attempted-recon; sid:200008778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/verifycheckpointpaqes/",nocase; classtype:attempted-recon; sid:200008779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/wwwinfopages091/",nocase; classtype:attempted-recon; sid:200008780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/04i569928qd9/bt",nocase; classtype:attempted-recon; sid:200008781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/0rt85yrht0ug349yed/btconnect",nocase; classtype:attempted-recon; sid:200008782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/103gn-securefacebook-page",nocase; classtype:attempted-recon; sid:200008783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/114g/bt",nocase; classtype:attempted-recon; sid:200008784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/122qw/btconneect",nocase; classtype:attempted-recon; sid:200008785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/1nepmw6/",nocase; classtype:attempted-recon; sid:200008786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/1q9lwuwhypgo3g1yh6rzwt3h2g38cr/",nocase; classtype:attempted-recon; sid:200008787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/1suzlemsjpqhmqukrg59sflthyz8h4/halaman-muka",nocase; classtype:attempted-recon; sid:200008788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/1wci9pimhsooitaqdvwsce7swz2jzf/",nocase; classtype:attempted-recon; sid:200008789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/2021o728/bt",nocase; classtype:attempted-recon; sid:200008790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/23456yu/btconecct?authuser=1",nocase; classtype:attempted-recon; sid:200008791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/23nt5c7jgr9cwcj43/btconnect",nocase; classtype:attempted-recon; sid:200008792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/2498475825728fe/bt",nocase; classtype:attempted-recon; sid:200008793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/276e/bt",nocase; classtype:attempted-recon; sid:200008794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/29t8g94787ry83yf34/btconnect",nocase; classtype:attempted-recon; sid:200008795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/32947y754t7737/bt",nocase; classtype:attempted-recon; sid:200008796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/33wq/btconnecct",nocase; classtype:attempted-recon; sid:200008797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/344rtfg/btconneec",nocase; classtype:attempted-recon; sid:200008798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/347568974202klvhddz/bt",nocase; classtype:attempted-recon; sid:200008799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/347587tesyrfe/bt",nocase; classtype:attempted-recon; sid:200008800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/3496564gbngff/bt",nocase; classtype:attempted-recon; sid:200008801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/3956787rrhdgu/bt",nocase; classtype:attempted-recon; sid:200008802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/3uyrdfg/bt",nocase; classtype:attempted-recon; sid:200008803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/434ef/btcoonneecc",nocase; classtype:attempted-recon; sid:200008804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/4354hjg/bt",nocase; classtype:attempted-recon; sid:200008805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/435rre/btconneecct",nocase; classtype:attempted-recon; sid:200008806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/437ryfrdj2se3dxe/bt",nocase; classtype:attempted-recon; sid:200008807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/4567yu/btconneect",nocase; classtype:attempted-recon; sid:200008808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/45ty/bt",nocase; classtype:attempted-recon; sid:200008809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/468754763857fgh/bt",nocase; classtype:attempted-recon; sid:200008810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/47653jgfgfhgf/bt",nocase; classtype:attempted-recon; sid:200008811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/50898t0tvucjbtbusiness/office365",nocase; classtype:attempted-recon; sid:200008812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/534rty/btconnecctt",nocase; classtype:attempted-recon; sid:200008813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/54tywf2038ur9vw4y/bt",nocase; classtype:attempted-recon; sid:200008814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/54uy8349wurvshnd/bt",nocase; classtype:attempted-recon; sid:200008815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/56he/btconnect",nocase; classtype:attempted-recon; sid:200008816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/57u4r389qwuesf323quewy98qew/btconnect",nocase; classtype:attempted-recon; sid:200008817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/57ytdf/bt",nocase; classtype:attempted-recon; sid:200008818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/583098t7t43q920112/bt",nocase; classtype:attempted-recon; sid:200008819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/584utgjf8430rkf/bt",nocase; classtype:attempted-recon; sid:200008820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/58658-5795-btrefundoffice365/office365",nocase; classtype:attempted-recon; sid:200008821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/5tbt/bt-business",nocase; classtype:attempted-recon; sid:200008822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/62374ytu/btconnecc?authuser=1",nocase; classtype:attempted-recon; sid:200008823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/657yttr/btconnecct",nocase; classtype:attempted-recon; sid:200008824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/65h7t65ygtdw5f4/bt",nocase; classtype:attempted-recon; sid:200008825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/74573478427892bt/bt",nocase; classtype:attempted-recon; sid:200008826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/7458694584hjgg/bt",nocase; classtype:attempted-recon; sid:200008827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/76767jkk/btbillpay",nocase; classtype:attempted-recon; sid:200008828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/777yujuyu65y/bt",nocase; classtype:attempted-recon; sid:200008829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/78578g/btconnnecct",nocase; classtype:attempted-recon; sid:200008830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/7876242342f/bt",nocase; classtype:attempted-recon; sid:200008831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/78t7487t82w9/bt",nocase; classtype:attempted-recon; sid:200008832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/7y7h7gv67r/btconnect",nocase; classtype:attempted-recon; sid:200008833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/8097tr6e56tyfhgjkl/office",nocase; classtype:attempted-recon; sid:200008834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/98yuk/bt",nocase; classtype:attempted-recon; sid:200008835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/9irgi3495iyf/btconnect",nocase; classtype:attempted-recon; sid:200008836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/aaazazaza/home",nocase; classtype:attempted-recon; sid:200008837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/abtbusinesx/home",nocase; classtype:attempted-recon; sid:200008838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/access-office-docxpdf-call-net/home",nocase; classtype:attempted-recon; sid:200008839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/acct-bt-service-upgrade/home",nocase; classtype:attempted-recon; sid:200008840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/accueil-b-p-postale/accueil",nocase; classtype:attempted-recon; sid:200008841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/acokbueklinkloginpage",nocase; classtype:attempted-recon; sid:200008842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/adesdaw/bt-business",nocase; classtype:attempted-recon; sid:200008843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/adexcun/home",nocase; classtype:attempted-recon; sid:200008844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/airaixe",nocase; classtype:attempted-recon; sid:200008845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/akgthrjfigjiosjfszdio/office365",nocase; classtype:attempted-recon; sid:200008846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/anythingbusinessok/bt",nocase; classtype:attempted-recon; sid:200008847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/anywordurchoiceiok/bt",nocase; classtype:attempted-recon; sid:200008848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/app-mobile-pages/",nocase; classtype:attempted-recon; sid:200008849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asaddsasdds/home",nocase; classtype:attempted-recon; sid:200008850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asbnfnvfjndvbt/btconnect",nocase; classtype:attempted-recon; sid:200008851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asddfgfdsdffggghhjjkkhg/bt",nocase; classtype:attempted-recon; sid:200008852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asdfghjklhgfdsdfgh/home",nocase; classtype:attempted-recon; sid:200008853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asdfsgr7u43y7w/btconnect",nocase; classtype:attempted-recon; sid:200008854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/aselok",nocase; classtype:attempted-recon; sid:200008855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asewrp",nocase; classtype:attempted-recon; sid:200008856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/askdnhojajs/office365",nocase; classtype:attempted-recon; sid:200008857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/askiop",nocase; classtype:attempted-recon; sid:200008858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asldsjilhjffkslfndk/btconnect",nocase; classtype:attempted-recon; sid:200008859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asloke",nocase; classtype:attempted-recon; sid:200008860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/aspols",nocase; classtype:attempted-recon; sid:200008861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asrweas",nocase; classtype:attempted-recon; sid:200008862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/atguytrewr/home",nocase; classtype:attempted-recon; sid:200008863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-communications/home",nocase; classtype:attempted-recon; sid:200008864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-managements/home",nocase; classtype:attempted-recon; sid:200008865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-server/home",nocase; classtype:attempted-recon; sid:200008866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-yahoomail",nocase; classtype:attempted-recon; sid:200008867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attmailgd/home",nocase; classtype:attempted-recon; sid:200008868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attteamail/home?authuser=2",nocase; classtype:attempted-recon; sid:200008869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attupdatinglog/home",nocase; classtype:attempted-recon; sid:200008870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attyahoo-connect/home",nocase; classtype:attempted-recon; sid:200008871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attyahooinc/home",nocase; classtype:attempted-recon; sid:200008872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/audio-call-net/home",nocase; classtype:attempted-recon; sid:200008873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/audopme/home",nocase; classtype:attempted-recon; sid:200008874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ball4l/bt-business",nocase; classtype:attempted-recon; sid:200008875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbbbttttt/bt",nocase; classtype:attempted-recon; sid:200008876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbbbvbvbvbvb/home",nocase; classtype:attempted-recon; sid:200008877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbroadbrandt/home",nocase; classtype:attempted-recon; sid:200008878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbtbbt/bt-business",nocase; classtype:attempted-recon; sid:200008879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbtbt-loginnnn/secure-bt-com",nocase; classtype:attempted-recon; sid:200008880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbttbt/bt-business",nocase; classtype:attempted-recon; sid:200008881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bcvcbv/home",nocase; classtype:attempted-recon; sid:200008882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bdhfewew/home",nocase; classtype:attempted-recon; sid:200008883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chase",nocase; classtype:attempted-recon; sid:200008884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chase-com",nocase; classtype:attempted-recon; sid:200008885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chasecom",nocase; classtype:attempted-recon; sid:200008886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bellsou/home",nocase; classtype:attempted-recon; sid:200008887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/benachrichtigung-sparkasse/accueil",nocase; classtype:attempted-recon; sid:200008888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bfdchgdjy",nocase; classtype:attempted-recon; sid:200008889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bibvbevb/home",nocase; classtype:attempted-recon; sid:200008890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billbtnew/bt",nocase; classtype:attempted-recon; sid:200008891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billready/btconnect",nocase; classtype:attempted-recon; sid:200008892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billsbt/bt",nocase; classtype:attempted-recon; sid:200008893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bimongosslao/home",nocase; classtype:attempted-recon; sid:200008894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bkjfeghrege438t/bt",nocase; classtype:attempted-recon; sid:200008895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrand/home",nocase; classtype:attempted-recon; sid:200008896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrandd/home",nocase; classtype:attempted-recon; sid:200008897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrands/home",nocase; classtype:attempted-recon; sid:200008898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrantd/home",nocase; classtype:attempted-recon; sid:200008899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bosiness/home",nocase; classtype:attempted-recon; sid:200008900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bradescodigital",nocase; classtype:attempted-recon; sid:200008901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/brandboardsuppor/home%3e%3chttps:/sites.google.com/view/brandboard/home",nocase; classtype:attempted-recon; sid:200008902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/broadbrand/home",nocase; classtype:attempted-recon; sid:200008903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/broadbrands/home",nocase; classtype:attempted-recon; sid:200008904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-ad/bt-stream",nocase; classtype:attempted-recon; sid:200008905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-b/home?authuser=6",nocase; classtype:attempted-recon; sid:200008906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-billlive/bt",nocase; classtype:attempted-recon; sid:200008907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud",nocase; classtype:attempted-recon; sid:200008908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-cloud-work-work/home?authuser=3",nocase; classtype:attempted-recon; sid:200008909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8",nocase; classtype:attempted-recon; sid:200008910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-defund/bt",nocase; classtype:attempted-recon; sid:200008911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-home--monthly-bill-failed/bt-comsecure-monthlybill?authuser=3",nocase; classtype:attempted-recon; sid:200008912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-jobs-page001/home?authuser=3",nocase; classtype:attempted-recon; sid:200008913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-log-1/bt",nocase; classtype:attempted-recon; sid:200008914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-loginbt/bt",nocase; classtype:attempted-recon; sid:200008915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-monthly--bill28/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-monthly-bill/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-monthly-bill23-10-2021/home?authuser=3",nocase; classtype:attempted-recon; sid:200008918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-monthly25-2021/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-newbill/bt",nocase; classtype:attempted-recon; sid:200008920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-notification/home",nocase; classtype:attempted-recon; sid:200008921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-office/bt",nocase; classtype:attempted-recon; sid:200008922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8",nocase; classtype:attempted-recon; sid:200008923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-readybill-/bt",nocase; classtype:attempted-recon; sid:200008924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-recover-id/home?authuser=1",nocase; classtype:attempted-recon; sid:200008925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-upgrade2021/home?authuser=1",nocase; classtype:attempted-recon; sid:200008926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-viewmybill/bt",nocase; classtype:attempted-recon; sid:200008927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-viewyourbill/bt",nocase; classtype:attempted-recon; sid:200008928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8",nocase; classtype:attempted-recon; sid:200008929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt1-office/bt",nocase; classtype:attempted-recon; sid:200008930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt1btconnectbusinesss/btconnect",nocase; classtype:attempted-recon; sid:200008931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt1business/btconnect",nocase; classtype:attempted-recon; sid:200008932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt3-office/bt",nocase; classtype:attempted-recon; sid:200008933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccess-review/bt",nocase; classtype:attempted-recon; sid:200008934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccess/bt",nocase; classtype:attempted-recon; sid:200008935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccessnow/bt",nocase; classtype:attempted-recon; sid:200008936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btacessbill/bt",nocase; classtype:attempted-recon; sid:200008937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btanalystic/home",nocase; classtype:attempted-recon; sid:200008938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-/bt",nocase; classtype:attempted-recon; sid:200008939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-7/bt",nocase; classtype:attempted-recon; sid:200008940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-office/bt",nocase; classtype:attempted-recon; sid:200008941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-paymentwu82/bt",nocase; classtype:attempted-recon; sid:200008942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-ready/bt",nocase; classtype:attempted-recon; sid:200008943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillbusiness-1/bt",nocase; classtype:attempted-recon; sid:200008944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillingbusiness/bt",nocase; classtype:attempted-recon; sid:200008945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillpayment-bt/bt",nocase; classtype:attempted-recon; sid:200008946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillpayment/bt",nocase; classtype:attempted-recon; sid:200008947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillreadynow/bt",nocase; classtype:attempted-recon; sid:200008948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillsecure/btconnect",nocase; classtype:attempted-recon; sid:200008949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillview/bt",nocase; classtype:attempted-recon; sid:200008950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btboardbrand/home",nocase; classtype:attempted-recon; sid:200008951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btboardbrands/home",nocase; classtype:attempted-recon; sid:200008952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbrandboarddd/home",nocase; classtype:attempted-recon; sid:200008953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbroadcfbandbills",nocase; classtype:attempted-recon; sid:200008954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbhome/bt-business",nocase; classtype:attempted-recon; sid:200008955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbt-preview-voice-page-/bt-cloud-voice",nocase; classtype:attempted-recon; sid:200008956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbt/bt",nocase; classtype:attempted-recon; sid:200008957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtb-cloud-voice00111/home",nocase; classtype:attempted-recon; sid:200008958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtbtb-upgrade-mailbox/bt-com",nocase; classtype:attempted-recon; sid:200008959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtbtbtcomm/home",nocase; classtype:attempted-recon; sid:200008960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtcloudvoice/bt-cloud-voice",nocase; classtype:attempted-recon; sid:200008961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbttt/bt-business",nocase; classtype:attempted-recon; sid:200008962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbuisness-home/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbuiss/home",nocase; classtype:attempted-recon; sid:200008964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusineso/bt?authuser=1",nocase; classtype:attempted-recon; sid:200008965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusiness-bt/home",nocase; classtype:attempted-recon; sid:200008966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusiness-viewyournewbill/bt",nocase; classtype:attempted-recon; sid:200008967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinessbillready/btconnect",nocase; classtype:attempted-recon; sid:200008968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinesscomm/bt-business",nocase; classtype:attempted-recon; sid:200008969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinesss/home?authuser=1",nocase; classtype:attempted-recon; sid:200008970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinesssecures/btconnect",nocase; classtype:attempted-recon; sid:200008971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinesssoffie/home",nocase; classtype:attempted-recon; sid:200008972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinessx/bt",nocase; classtype:attempted-recon; sid:200008973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbussiiness/home",nocase; classtype:attempted-recon; sid:200008974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcloud-1/bt",nocase; classtype:attempted-recon; sid:200008975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1",nocase; classtype:attempted-recon; sid:200008976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btco/home",nocase; classtype:attempted-recon; sid:200008977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcommm0ffice365/office365",nocase; classtype:attempted-recon; sid:200008978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcommss365office/office365",nocase; classtype:attempted-recon; sid:200008979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcomss0ffice365/office365",nocase; classtype:attempted-recon; sid:200008980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-group-plc/home",nocase; classtype:attempted-recon; sid:200008981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-month-bill/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-bill/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-bill27/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-bill27/secure-bt-com?authuser=3&data=04",nocase; classtype:attempted-recon; sid:200008985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-bill28/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-bills/secure-bt-com/?authuser=3",nocase; classtype:attempted-recon; sid:200008987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly-payment/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-monthly/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-update05/my-bt-update?authuser=3",nocase; classtype:attempted-recon; sid:200008990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-validate2021/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-voice-cloud/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200008992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect2021/home",nocase; classtype:attempted-recon; sid:200008993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectbusiness/btconnect",nocase; classtype:attempted-recon; sid:200008994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectgroupplc/home",nocase; classtype:attempted-recon; sid:200008995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectmailserver/home",nocase; classtype:attempted-recon; sid:200008996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectoffice3655/office365",nocase; classtype:attempted-recon; sid:200008997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectready-bill/bt",nocase; classtype:attempted-recon; sid:200008998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectttt/bt",nocase; classtype:attempted-recon; sid:200008999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectvoicemail-weebly-com/btconnectvm-com",nocase; classtype:attempted-recon; sid:200009000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btdhjjbtbtbusiness/btbusiness",nocase; classtype:attempted-recon; sid:200009001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btfhdbsjuhjf/btconnect",nocase; classtype:attempted-recon; sid:200009002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btfsdbkmvxcbusinesss/office365",nocase; classtype:attempted-recon; sid:200009003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bthomelive2021updatepdf-ads/home",nocase; classtype:attempted-recon; sid:200009004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bthomelog1/home",nocase; classtype:attempted-recon; sid:200009005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinserve2/home",nocase; classtype:attempted-recon; sid:200009006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetco/home",nocase; classtype:attempted-recon; sid:200009007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetconectey/home",nocase; classtype:attempted-recon; sid:200009008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinterneto/home",nocase; classtype:attempted-recon; sid:200009009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetonline/home",nocase; classtype:attempted-recon; sid:200009010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetreview/home",nocase; classtype:attempted-recon; sid:200009011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetverificatioamil/home",nocase; classtype:attempted-recon; sid:200009012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btissecurelogin/btconnect",nocase; classtype:attempted-recon; sid:200009013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btliveconnect/btconnect",nocase; classtype:attempted-recon; sid:200009014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btlogin-n/home",nocase; classtype:attempted-recon; sid:200009015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btloginbilll/bt",nocase; classtype:attempted-recon; sid:200009016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btloginfo/bt",nocase; classtype:attempted-recon; sid:200009017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btlsecurelog/bt",nocase; classtype:attempted-recon; sid:200009018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthly-bill27-10-2021/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200009019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlybill-1/bt",nocase; classtype:attempted-recon; sid:200009020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlybill/bt",nocase; classtype:attempted-recon; sid:200009021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlynewbill/bt",nocase; classtype:attempted-recon; sid:200009022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlynewpayment/bt",nocase; classtype:attempted-recon; sid:200009023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlypayment/bt",nocase; classtype:attempted-recon; sid:200009024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8",nocase; classtype:attempted-recon; sid:200009025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnet/home",nocase; classtype:attempted-recon; sid:200009026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnew-bill/bt",nocase; classtype:attempted-recon; sid:200009027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill-1/bt",nocase; classtype:attempted-recon; sid:200009028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill-payment/bt",nocase; classtype:attempted-recon; sid:200009029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill/bt",nocase; classtype:attempted-recon; sid:200009030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbills/bt",nocase; classtype:attempted-recon; sid:200009031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewloginbill/bt",nocase; classtype:attempted-recon; sid:200009032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewweekbill/bt",nocase; classtype:attempted-recon; sid:200009033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1",nocase; classtype:attempted-recon; sid:200009034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoffice-2/bt",nocase; classtype:attempted-recon; sid:200009035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoffice-log/bt",nocase; classtype:attempted-recon; sid:200009036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoffice365btcomms/bt",nocase; classtype:attempted-recon; sid:200009037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btofficeaccess/bt",nocase; classtype:attempted-recon; sid:200009038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btofficece/office",nocase; classtype:attempted-recon; sid:200009039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoficialbusiness20i21/office365",nocase; classtype:attempted-recon; sid:200009040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btonlineserver/btpasswordsector",nocase; classtype:attempted-recon; sid:200009041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btooolgoooozzzz/home?authuser=3",nocase; classtype:attempted-recon; sid:200009042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpayment-31st/bt",nocase; classtype:attempted-recon; sid:200009043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpaymentbill/bt",nocase; classtype:attempted-recon; sid:200009044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpaymentnew/bt",nocase; classtype:attempted-recon; sid:200009045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpdfbill-002/bt-home",nocase; classtype:attempted-recon; sid:200009046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpermanentbill/bt",nocase; classtype:attempted-recon; sid:200009047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btplcgroup/home",nocase; classtype:attempted-recon; sid:200009048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btready-bill-/bt",nocase; classtype:attempted-recon; sid:200009049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btreal/bt",nocase; classtype:attempted-recon; sid:200009050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btrequestbill/bt",nocase; classtype:attempted-recon; sid:200009051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btreset/bt",nocase; classtype:attempted-recon; sid:200009052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btsportl/home",nocase; classtype:attempted-recon; sid:200009053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttbht/bt-business",nocase; classtype:attempted-recon; sid:200009054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttboardbrand/home",nocase; classtype:attempted-recon; sid:200009055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttbusinesssss/home",nocase; classtype:attempted-recon; sid:200009056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttelecommunication/bt",nocase; classtype:attempted-recon; sid:200009057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttnet/home",nocase; classtype:attempted-recon; sid:200009058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdate-1/bt",nocase; classtype:attempted-recon; sid:200009059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdate-bill/bt",nocase; classtype:attempted-recon; sid:200009060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdatepage/bt",nocase; classtype:attempted-recon; sid:200009061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btvailmus/home",nocase; classtype:attempted-recon; sid:200009062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-/bt",nocase; classtype:attempted-recon; sid:200009063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-bill-bt/bt",nocase; classtype:attempted-recon; sid:200009064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-bills/bt",nocase; classtype:attempted-recon; sid:200009065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill-/bt",nocase; classtype:attempted-recon; sid:200009066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill-11/bt",nocase; classtype:attempted-recon; sid:200009067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill/bt",nocase; classtype:attempted-recon; sid:200009068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewebill/bt",nocase; classtype:attempted-recon; sid:200009069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businesbill-view/bt",nocase; classtype:attempted-recon; sid:200009070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businesbt/business-bt?authuser=1",nocase; classtype:attempted-recon; sid:200009071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessbtoff/business",nocase; classtype:attempted-recon; sid:200009072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessbtsecure/bt-business",nocase; classtype:attempted-recon; sid:200009073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessbtt/business",nocase; classtype:attempted-recon; sid:200009074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businesschoiceok/bt",nocase; classtype:attempted-recon; sid:200009075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessofficebt/bt-business",nocase; classtype:attempted-recon; sid:200009076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bvbnvnvn/home",nocase; classtype:attempted-recon; sid:200009077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bvbvvbvbvb/home",nocase; classtype:attempted-recon; sid:200009078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bvnnvmvm/home",nocase; classtype:attempted-recon; sid:200009079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cancel-deactivate/bt-com",nocase; classtype:attempted-recon; sid:200009080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/capitaloneloginus/home",nocase; classtype:attempted-recon; sid:200009081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/carinapwapw/bt-business",nocase; classtype:attempted-recon; sid:200009082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/centers-notice-comunity/fbs-confrims",nocase; classtype:attempted-recon; sid:200009083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/certicodeplus2/accueil",nocase; classtype:attempted-recon; sid:200009084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkbillbt/bt",nocase; classtype:attempted-recon; sid:200009085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkbt/bt",nocase; classtype:attempted-recon; sid:200009086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkinbt/bt",nocase; classtype:attempted-recon; sid:200009087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/chjh-yjbucy-nngfv-hnfgmnx-bt/office365",nocase; classtype:attempted-recon; sid:200009088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/choicebusiness/bt",nocase; classtype:attempted-recon; sid:200009089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ciix/home",nocase; classtype:attempted-recon; sid:200009090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/clickbtconnect/home?authuser=1",nocase; classtype:attempted-recon; sid:200009091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/clickonlinerevs/in%c3%adcio",nocase; classtype:attempted-recon; sid:200009092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cnvruwhy3q78eq2/btconnect",nocase; classtype:attempted-recon; sid:200009093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm",nocase; classtype:attempted-recon; sid:200009094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/colv2/accueil?authuser=7",nocase; classtype:attempted-recon; sid:200009095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/communication-serveurrdpg/accueil",nocase; classtype:attempted-recon; sid:200009096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/confirm-new-page2021",nocase; classtype:attempted-recon; sid:200009097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/congratulationperfect/accueil",nocase; classtype:attempted-recon; sid:200009098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/credit-agricole-faccueilca/accueil",nocase; classtype:attempted-recon; sid:200009099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ctz03",nocase; classtype:attempted-recon; sid:200009100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cupmuwas/home",nocase; classtype:attempted-recon; sid:200009101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/currentlyatt/home",nocase; classtype:attempted-recon; sid:200009102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/customerchoiceok/bt",nocase; classtype:attempted-recon; sid:200009103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cw-6yt5vbyn-u6543w/btsecured",nocase; classtype:attempted-recon; sid:200009104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dashesdl00",nocase; classtype:attempted-recon; sid:200009105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dedehyhg/home",nocase; classtype:attempted-recon; sid:200009106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/derrtrttt/home",nocase; classtype:attempted-recon; sid:200009107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/detail-info/details",nocase; classtype:attempted-recon; sid:200009108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfbjkzdmktmhzlhdjtgzdjzzjs/office365",nocase; classtype:attempted-recon; sid:200009109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhckuyf/home",nocase; classtype:attempted-recon; sid:200009110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhl/home",nocase; classtype:attempted-recon; sid:200009111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjkllkgfdfghkljkkjhg/office365",nocase; classtype:attempted-recon; sid:200009112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfhjklkjhgfddfzhxjcjk/office365",nocase; classtype:attempted-recon; sid:200009113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dhvjcnzxhxcbt/bt-business",nocase; classtype:attempted-recon; sid:200009114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djgfdgzogjsm-js-riyavet-hbt/office365",nocase; classtype:attempted-recon; sid:200009115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djkfghwug75/bt",nocase; classtype:attempted-recon; sid:200009116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djklgfnj-jkjxukyuip97/office365",nocase; classtype:attempted-recon; sid:200009117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dnrkjbhtevsge/btconnect",nocase; classtype:attempted-recon; sid:200009118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dododokido/home",nocase; classtype:attempted-recon; sid:200009119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dofjghiohfsihf/bt",nocase; classtype:attempted-recon; sid:200009120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dosfdhdgkbmdzgjzoalzgk/office365",nocase; classtype:attempted-recon; sid:200009121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/drakio/bt-business",nocase; classtype:attempted-recon; sid:200009122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ds-fd9dtry6yur/bt",nocase; classtype:attempted-recon; sid:200009123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsfghjkkjhgf/btconnect",nocase; classtype:attempted-recon; sid:200009124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsfgnjfncsxjzxbtbusiness/btconnect",nocase; classtype:attempted-recon; sid:200009125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dshfjhdufhsd3583/bt",nocase; classtype:attempted-recon; sid:200009126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsjbnsdkfgndhjfjzoim/365office",nocase; classtype:attempted-recon; sid:200009127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsvhv74t43/bt",nocase; classtype:attempted-recon; sid:200009128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/duf/bt",nocase; classtype:attempted-recon; sid:200009129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dugsjdjz/btconnect",nocase; classtype:attempted-recon; sid:200009130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dyinglasto/accueil",nocase; classtype:attempted-recon; sid:200009131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/efdgfkdsdjfvsizobkl/office365",nocase; classtype:attempted-recon; sid:200009132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ejgijibfgvfk-x/btconnect",nocase; classtype:attempted-recon; sid:200009133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ekofederal/bt-business",nocase; classtype:attempted-recon; sid:200009134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/esfgjdgfshggd58-btbillrepaymnt/office365",nocase; classtype:attempted-recon; sid:200009135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/espacemessagerieorangesms/accueil",nocase; classtype:attempted-recon; sid:200009136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/esuniketegbe/bt-business",nocase; classtype:attempted-recon; sid:200009137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect",nocase; classtype:attempted-recon; sid:200009138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/exodus-rewards-eth",nocase; classtype:attempted-recon; sid:200009139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/facturemob-boxligne/accueil",nocase; classtype:attempted-recon; sid:200009140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fbs-confrim/",nocase; classtype:attempted-recon; sid:200009141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fbtt/bt-business",nocase; classtype:attempted-recon; sid:200009142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fdbt-bsuinesskbcksfjz/office365",nocase; classtype:attempted-recon; sid:200009143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fdfsdsdeuuuuuuup/home",nocase; classtype:attempted-recon; sid:200009144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fdnjcnkvjxk/bt",nocase; classtype:attempted-recon; sid:200009145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/feelblessed/bt-business",nocase; classtype:attempted-recon; sid:200009146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ffjhgfnbgbpdjbvduvbwv/bt",nocase; classtype:attempted-recon; sid:200009147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fgbhlzjcsn/bt",nocase; classtype:attempted-recon; sid:200009148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fggtg/home",nocase; classtype:attempted-recon; sid:200009149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fghjgjfhjmmfngc/home",nocase; classtype:attempted-recon; sid:200009150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fghjgjfhjmmfngc/home/",nocase; classtype:attempted-recon; sid:200009151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fgjdfghduhdxuxu/home",nocase; classtype:attempted-recon; sid:200009152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fgjhdsfhsaj45698432/bt",nocase; classtype:attempted-recon; sid:200009153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fgrgrtrrer/home",nocase; classtype:attempted-recon; sid:200009154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fhfv-btcoplc/bt",nocase; classtype:attempted-recon; sid:200009155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fjgfd4350986493/home",nocase; classtype:attempted-recon; sid:200009156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fkjbkjgfdjigbt/btbusiness",nocase; classtype:attempted-recon; sid:200009157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/flhlzjgkj54iu954i3/bt",nocase; classtype:attempted-recon; sid:200009158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fod-terug/homepage",nocase; classtype:attempted-recon; sid:200009159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/freshtotal/bt",nocase; classtype:attempted-recon; sid:200009160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ftxus-exchange/trang-ch%e1%bb%a7",nocase; classtype:attempted-recon; sid:200009161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/g5u89gy43yw/bt",nocase; classtype:attempted-recon; sid:200009162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gaoud/home",nocase; classtype:attempted-recon; sid:200009163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gdhdhgfgfhfh/home",nocase; classtype:attempted-recon; sid:200009164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gdrtv/bt-business",nocase; classtype:attempted-recon; sid:200009165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gdtrgtagtahgsffsrwrw/home",nocase; classtype:attempted-recon; sid:200009166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gduhjzfughbfld/office365",nocase; classtype:attempted-recon; sid:200009167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gdygdfppppowlwoe/home",nocase; classtype:attempted-recon; sid:200009168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gegevens/homepage",nocase; classtype:attempted-recon; sid:200009169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gfafffsvsvsgvfsfjsk/home",nocase; classtype:attempted-recon; sid:200009170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gfgherbviughegbn/bt",nocase; classtype:attempted-recon; sid:200009171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gfijghy6j584w/bt",nocase; classtype:attempted-recon; sid:200009172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gftgfhfgfh/home",nocase; classtype:attempted-recon; sid:200009173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghdgehe/home?authuser=4",nocase; classtype:attempted-recon; sid:200009174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghghgjdj/home",nocase; classtype:attempted-recon; sid:200009175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghgjlkhfjgggwgwgr/bt",nocase; classtype:attempted-recon; sid:200009176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghjkdghgfhgbt/btconnect",nocase; classtype:attempted-recon; sid:200009177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghjkuytrdfgh/home",nocase; classtype:attempted-recon; sid:200009178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghkhhgggfcgbusiness/bt",nocase; classtype:attempted-recon; sid:200009179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghkkjjl/home",nocase; classtype:attempted-recon; sid:200009180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gjhjhkj/home",nocase; classtype:attempted-recon; sid:200009181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gnvkbckccv/bt",nocase; classtype:attempted-recon; sid:200009182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/googluxxk/bt-business",nocase; classtype:attempted-recon; sid:200009183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gragranodeystopniiiiieheh/home",nocase; classtype:attempted-recon; sid:200009184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gsdfghogvtydtucvbiuujb/btconnect?authuser=2",nocase; classtype:attempted-recon; sid:200009185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gtdtfhghj/home",nocase; classtype:attempted-recon; sid:200009186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hbtbt/bt-business",nocase; classtype:attempted-recon; sid:200009187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hccwc/home",nocase; classtype:attempted-recon; sid:200009188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hdcbju/home",nocase; classtype:attempted-recon; sid:200009189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/helps-identysconfirmsupp/fbs-confrims",nocase; classtype:attempted-recon; sid:200009190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hfftfuj/home",nocase; classtype:attempted-recon; sid:200009191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hfghjhhjkg/bt",nocase; classtype:attempted-recon; sid:200009192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hfjhvdsdhncz/btconnect",nocase; classtype:attempted-recon; sid:200009193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hfstyhi/home",nocase; classtype:attempted-recon; sid:200009194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hfsyfysghgsd/home",nocase; classtype:attempted-recon; sid:200009195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgddgdjd/home",nocase; classtype:attempted-recon; sid:200009196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgdfwer/bt",nocase; classtype:attempted-recon; sid:200009197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgdygduhd/home",nocase; classtype:attempted-recon; sid:200009198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgsfdlopapopopaoos/home",nocase; classtype:attempted-recon; sid:200009199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgsfgs/bt-business",nocase; classtype:attempted-recon; sid:200009200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgxhdfg",nocase; classtype:attempted-recon; sid:200009201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgygj/home",nocase; classtype:attempted-recon; sid:200009202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hiudrfsdgh/home",nocase; classtype:attempted-recon; sid:200009203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hjyuhijhiukhghjk/home",nocase; classtype:attempted-recon; sid:200009204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hkkllklkkl/home",nocase; classtype:attempted-recon; sid:200009205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hombtbt/bt-business",nocase; classtype:attempted-recon; sid:200009206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-bt-updates/bt-com",nocase; classtype:attempted-recon; sid:200009207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-btconnect-bills/home",nocase; classtype:attempted-recon; sid:200009208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-btconnect-monthly-bills/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200009209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-btmonthly-bill/bt-home-come?authuser=3",nocase; classtype:attempted-recon; sid:200009210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/homebt/bt-home",nocase; classtype:attempted-recon; sid:200009211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/homebtbt/bt-business",nocase; classtype:attempted-recon; sid:200009212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/homebtbtbt/bt-business",nocase; classtype:attempted-recon; sid:200009213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hopepppilllmnnbpqw/home",nocase; classtype:attempted-recon; sid:200009214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hornygirlc/home",nocase; classtype:attempted-recon; sid:200009215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hsggdnnnnnvvvvdccxhhsh/home",nocase; classtype:attempted-recon; sid:200009216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hsgyfygx/home",nocase; classtype:attempted-recon; sid:200009217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hsyfdyd/home",nocase; classtype:attempted-recon; sid:200009218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/htvvss/home?authuser=3",nocase; classtype:attempted-recon; sid:200009219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hxdgucguchck/home",nocase; classtype:attempted-recon; sid:200009220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/i47r093q89y8teg/bt",nocase; classtype:attempted-recon; sid:200009221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/i86edssertuilmjuj00u7trr45r4/home",nocase; classtype:attempted-recon; sid:200009222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ichaba-lavish/bt-businexs",nocase; classtype:attempted-recon; sid:200009223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/identy-helps-confrim/",nocase; classtype:attempted-recon; sid:200009224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/identyyc-helpsm20/",nocase; classtype:attempted-recon; sid:200009225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ieeroekroeedldiorjkfrkfk/home",nocase; classtype:attempted-recon; sid:200009226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ieurf/bt",nocase; classtype:attempted-recon; sid:200009227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ifhveu0wu4t8hrd9/btconnect",nocase; classtype:attempted-recon; sid:200009228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ii-securepage-facebook",nocase; classtype:attempted-recon; sid:200009229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/incomingdocument/home",nocase; classtype:attempted-recon; sid:200009230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoice-payment-pdf/home",nocase; classtype:attempted-recon; sid:200009231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoice-payment/home",nocase; classtype:attempted-recon; sid:200009232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/issue-community/",nocase; classtype:attempted-recon; sid:200009233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/issue-community/views",nocase; classtype:attempted-recon; sid:200009234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/iuouoip/home",nocase; classtype:attempted-recon; sid:200009235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/iuyggdt/bt",nocase; classtype:attempted-recon; sid:200009236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/iyu01-securepage-facebook",nocase; classtype:attempted-recon; sid:200009237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jbgirurih4fna/btconnect",nocase; classtype:attempted-recon; sid:200009238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jbtb/bt-business",nocase; classtype:attempted-recon; sid:200009239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jcnvvn/home",nocase; classtype:attempted-recon; sid:200009240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jdgugusgis/home",nocase; classtype:attempted-recon; sid:200009241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jfeknshdjhzsjhvdukhxbt/btconnect",nocase; classtype:attempted-recon; sid:200009242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jfrijsufe0rjgplsvkdm/office365",nocase; classtype:attempted-recon; sid:200009243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jgvh-thtssmvvhhvcvyghbjnkgrdty/office365",nocase; classtype:attempted-recon; sid:200009244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jgxuhdi/home",nocase; classtype:attempted-recon; sid:200009245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jhddd/bt",nocase; classtype:attempted-recon; sid:200009246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jhsdgsus/home",nocase; classtype:attempted-recon; sid:200009247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jkfdskghw8484/bt",nocase; classtype:attempted-recon; sid:200009248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jkibdvxthbbt/btconnect",nocase; classtype:attempted-recon; sid:200009249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jmjmnhvdc/home",nocase; classtype:attempted-recon; sid:200009250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jmnhgdfvasxhjfk/office365",nocase; classtype:attempted-recon; sid:200009251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/johnbullmysonisenttttiyoutosch/home",nocase; classtype:attempted-recon; sid:200009252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jsdfkhjfjhfjgkumf-dhf/office365",nocase; classtype:attempted-recon; sid:200009253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jsdkfdggstjhkgdfshj-bts-bgnhdg/office365",nocase; classtype:attempted-recon; sid:200009254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kayodemi/home",nocase; classtype:attempted-recon; sid:200009255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kcmkdskfjgvbt/btbusiness",nocase; classtype:attempted-recon; sid:200009256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/keepcurrentbt/bt",nocase; classtype:attempted-recon; sid:200009257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kfjdgfgkfofigcvbbt/btconnect",nocase; classtype:attempted-recon; sid:200009258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kjdfdjgkjfcj/bt",nocase; classtype:attempted-recon; sid:200009259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kjkjkjkjjkk/home",nocase; classtype:attempted-recon; sid:200009260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ksdzfgknkxbt/btbusiness",nocase; classtype:attempted-recon; sid:200009261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ktaonline",nocase; classtype:attempted-recon; sid:200009262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/labred-authentification-source/accueil",nocase; classtype:attempted-recon; sid:200009263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/lateatnight/bt-business",nocase; classtype:attempted-recon; sid:200009264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/leafadd/accueil",nocase; classtype:attempted-recon; sid:200009265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/login-bt/bt",nocase; classtype:attempted-recon; sid:200009266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loginbt/btconnect",nocase; classtype:attempted-recon; sid:200009267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loginyourbill/bt",nocase; classtype:attempted-recon; sid:200009268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/lolollololppp/home",nocase; classtype:attempted-recon; sid:200009269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loouygj/home",nocase; classtype:attempted-recon; sid:200009270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loveofyourlifeebineroooo/home",nocase; classtype:attempted-recon; sid:200009271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/madmandeywishmybadsdd/home",nocase; classtype:attempted-recon; sid:200009272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mail_check0.godaddysites.com/",nocase; classtype:attempted-recon; sid:200009273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mail_checkin.godaddysites.com/",nocase; classtype:attempted-recon; sid:200009274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/maillogobt/home",nocase; classtype:attempted-recon; sid:200009275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mailnlinkbtmila/home",nocase; classtype:attempted-recon; sid:200009276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mapeeeeemipaapaodkdjrrddd/home",nocase; classtype:attempted-recon; sid:200009277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/maryannvexingforyou/home",nocase; classtype:attempted-recon; sid:200009278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mayaayayygdgdtryme/home",nocase; classtype:attempted-recon; sid:200009279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mcwdbvefjberjrwgnwriviwr/home",nocase; classtype:attempted-recon; sid:200009280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mgqy58ueytqg6lvzko5q/",nocase; classtype:attempted-recon; sid:200009281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/micraosaftefficei/bt",nocase; classtype:attempted-recon; sid:200009282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/microsoftoutlookk/office",nocase; classtype:attempted-recon; sid:200009283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mmse/home",nocase; classtype:attempted-recon; sid:200009284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-fbmss/halaman-muka",nocase; classtype:attempted-recon; sid:200009285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-pages-/",nocase; classtype:attempted-recon; sid:200009286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-redirect-pages/",nocase; classtype:attempted-recon; sid:200009287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-show/",nocase; classtype:attempted-recon; sid:200009288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-show/home",nocase; classtype:attempted-recon; sid:200009289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-site-pages/pages",nocase; classtype:attempted-recon; sid:200009290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-system-clik",nocase; classtype:attempted-recon; sid:200009291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-system-redirect/",nocase; classtype:attempted-recon; sid:200009292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-tags/",nocase; classtype:attempted-recon; sid:200009293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monsitewebfacture888/accueil",nocase; classtype:attempted-recon; sid:200009294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monthly-bill-reveiw00o0o1/bt-com",nocase; classtype:attempted-recon; sid:200009295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monthly-bill/secure-bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200009296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monthly-bt-bill/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200009297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mrypttyoooedyrecscx/home",nocase; classtype:attempted-recon; sid:200009298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mv-voicepage/home?authuser=8",nocase; classtype:attempted-recon; sid:200009299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybillready/btconect",nocase; classtype:attempted-recon; sid:200009300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybt273ehdjsecure/bt-business",nocase; classtype:attempted-recon; sid:200009301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill--1/bt",nocase; classtype:attempted-recon; sid:200009302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill-1/bt",nocase; classtype:attempted-recon; sid:200009303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill-new/bt",nocase; classtype:attempted-recon; sid:200009304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbilllogin/bt",nocase; classtype:attempted-recon; sid:200009305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbillpayment/bt",nocase; classtype:attempted-recon; sid:200009306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtnewbill/bt",nocase; classtype:attempted-recon; sid:200009307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtsececurvaytvfcigfdtcvbd/bt",nocase; classtype:attempted-recon; sid:200009308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mycoinwallet/",nocase; classtype:attempted-recon; sid:200009309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mymailbox/home",nocase; classtype:attempted-recon; sid:200009310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nbcxkjbhxjczkxjncvxbt/btconnect",nocase; classtype:attempted-recon; sid:200009311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nbtbt/bt-business",nocase; classtype:attempted-recon; sid:200009312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/new-btbill/bt",nocase; classtype:attempted-recon; sid:200009313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newbtbill/bt",nocase; classtype:attempted-recon; sid:200009314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newbtmissedcall/home",nocase; classtype:attempted-recon; sid:200009315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newmailgabnaccess/home",nocase; classtype:attempted-recon; sid:200009316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newvoicemail/home?authuser=1",nocase; classtype:attempted-recon; sid:200009317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nhnhnhnhnhnnh/home",nocase; classtype:attempted-recon; sid:200009318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nimomokdldlsss/home",nocase; classtype:attempted-recon; sid:200009319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nmmmnnnnmm/home",nocase; classtype:attempted-recon; sid:200009320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nmnbnb/home",nocase; classtype:attempted-recon; sid:200009321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nmnmnnbvbv/home",nocase; classtype:attempted-recon; sid:200009322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/no-reply-btconnect-bill/secure-bt-com/?authuser=3",nocase; classtype:attempted-recon; sid:200009323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notification-bussines/",nocase; classtype:attempted-recon; sid:200009324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notification-messages/",nocase; classtype:attempted-recon; sid:200009325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notification-pages-info/views",nocase; classtype:attempted-recon; sid:200009326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notificationpublicpage",nocase; classtype:attempted-recon; sid:200009327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/nvnvnvnvv/home",nocase; classtype:attempted-recon; sid:200009328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oaweisrt394w/btconnect",nocase; classtype:attempted-recon; sid:200009329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ob-orangebank/accueil",nocase; classtype:attempted-recon; sid:200009330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office-btlogin/bt",nocase; classtype:attempted-recon; sid:200009331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office365btcomm/office365",nocase; classtype:attempted-recon; sid:200009332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office365btcomms/office-365",nocase; classtype:attempted-recon; sid:200009333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office365btcommss/office365",nocase; classtype:attempted-recon; sid:200009334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office365btcomss/office365",nocase; classtype:attempted-recon; sid:200009335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/office365bttelecoms/office",nocase; classtype:attempted-recon; sid:200009336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/officebt-bill-1/bt",nocase; classtype:attempted-recon; sid:200009337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/officebt-bill-1/bt&data=04",nocase; classtype:attempted-recon; sid:200009338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/offiice-voice-com/home",nocase; classtype:attempted-recon; sid:200009339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oihgf/bt",nocase; classtype:attempted-recon; sid:200009340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiugfdhbjnk/bt",nocase; classtype:attempted-recon; sid:200009341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiuyfdsdfghj/bt",nocase; classtype:attempted-recon; sid:200009342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiuytf/bt",nocase; classtype:attempted-recon; sid:200009343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oixdfjdfjzkkbt-76-business/office365",nocase; classtype:attempted-recon; sid:200009344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/omobabaolowonofitdie/home",nocase; classtype:attempted-recon; sid:200009345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/onlinechoiceok/bt",nocase; classtype:attempted-recon; sid:200009346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/operateur-communication999/accueil",nocase; classtype:attempted-recon; sid:200009347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/opopipipop/home",nocase; classtype:attempted-recon; sid:200009348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange--bank--france--/accueil",nocase; classtype:attempted-recon; sid:200009349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange--bank/accueil",nocase; classtype:attempted-recon; sid:200009350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-ba30/accueil",nocase; classtype:attempted-recon; sid:200009351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-ba55/accueil",nocase; classtype:attempted-recon; sid:200009352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-ba90/accueil",nocase; classtype:attempted-recon; sid:200009353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-bank-/accueil",nocase; classtype:attempted-recon; sid:200009354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-bank-france-/accueil",nocase; classtype:attempted-recon; sid:200009355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-bank-securite/accueil",nocase; classtype:attempted-recon; sid:200009356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-bank/accueil",nocase; classtype:attempted-recon; sid:200009357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-2/accueil",nocase; classtype:attempted-recon; sid:200009358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-servic/accueil",nocase; classtype:attempted-recon; sid:200009359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-service/accueil",nocase; classtype:attempted-recon; sid:200009360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebankfrance/accueil?utm_source=newsletter&utm_medium=email&utm_campaign=bienvenue+solde+80%25",nocase; classtype:attempted-recon; sid:200009361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangemsg/accueil",nocase; classtype:attempted-recon; sid:200009362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ouiiuouo/home",nocase; classtype:attempted-recon; sid:200009363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/page-information/",nocase; classtype:attempted-recon; sid:200009364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pages-notification/details",nocase; classtype:attempted-recon; sid:200009365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paginadetectada",nocase; classtype:attempted-recon; sid:200009366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pass-press/accueil",nocase; classtype:attempted-recon; sid:200009367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/passoip/accueil",nocase; classtype:attempted-recon; sid:200009368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/payment-1/bt",nocase; classtype:attempted-recon; sid:200009369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-customer-services/",nocase; classtype:attempted-recon; sid:200009370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-loginn/",nocase; classtype:attempted-recon; sid:200009371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypalloginsignin",nocase; classtype:attempted-recon; sid:200009372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypalloginsignin/",nocase; classtype:attempted-recon; sid:200009373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/payyourbill/bt",nocase; classtype:attempted-recon; sid:200009374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3",nocase; classtype:attempted-recon; sid:200009375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pidenty-policy/",nocase; classtype:attempted-recon; sid:200009376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pizzad/home?authuser=1",nocase; classtype:attempted-recon; sid:200009377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/plkbf/bt",nocase; classtype:attempted-recon; sid:200009378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/plstalktomeeeeeejowowwoo/home",nocase; classtype:attempted-recon; sid:200009379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/plugtopeckham/bt-business",nocase; classtype:attempted-recon; sid:200009380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pompomsx/bt-business",nocase; classtype:attempted-recon; sid:200009381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/popopopi/home",nocase; classtype:attempted-recon; sid:200009382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/postacerticodplusaccaccueil/accueil",nocase; classtype:attempted-recon; sid:200009383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/q999999999999999999999wettttty/home",nocase; classtype:attempted-recon; sid:200009384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/qwerrrt/home",nocase; classtype:attempted-recon; sid:200009385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/qwettttty/home",nocase; classtype:attempted-recon; sid:200009386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/randompacal/bt",nocase; classtype:attempted-recon; sid:200009387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/readybillbt/btconnec",nocase; classtype:attempted-recon; sid:200009388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/readynewbill/bt",nocase; classtype:attempted-recon; sid:200009389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/realbtreadybill-hdebvuhij/bt",nocase; classtype:attempted-recon; sid:200009390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/recovery-mobile/mobile",nocase; classtype:attempted-recon; sid:200009391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/recoverypagenew2021",nocase; classtype:attempted-recon; sid:200009392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/redirect-lock/home",nocase; classtype:attempted-recon; sid:200009393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/restoreasswordjbt/btconnect",nocase; classtype:attempted-recon; sid:200009394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reviewappspagerviice/",nocase; classtype:attempted-recon; sid:200009395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reviewbt/home",nocase; classtype:attempted-recon; sid:200009396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/richcoff/bt-business",nocase; classtype:attempted-recon; sid:200009397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rkgjhfkgnkgfgdkzxkzdx/office365",nocase; classtype:attempted-recon; sid:200009398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rrjkfjdlfdsbt/btconnect",nocase; classtype:attempted-recon; sid:200009399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rtsadyffuvfoi/home",nocase; classtype:attempted-recon; sid:200009400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ru56958938218-bt/bt",nocase; classtype:attempted-recon; sid:200009401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/s00420122kl-t2",nocase; classtype:attempted-recon; sid:200009402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sadsvfghnjdmackngd/office365",nocase; classtype:attempted-recon; sid:200009403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sceure-btconect-home-activate/bt-com?authuser=3",nocase; classtype:attempted-recon; sid:200009404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/scvbnmiuytrertyuiuytty/home",nocase; classtype:attempted-recon; sid:200009405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sddfgggf/home",nocase; classtype:attempted-recon; sid:200009406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sddssfsfsf/home",nocase; classtype:attempted-recon; sid:200009407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sdfhjkjhasdghj/home",nocase; classtype:attempted-recon; sid:200009408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sdfjgdsjfgdhxkzjsbt/btconnect",nocase; classtype:attempted-recon; sid:200009409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sdryljfgdfbt/btconnect",nocase; classtype:attempted-recon; sid:200009410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secbt/bt-home",nocase; classtype:attempted-recon; sid:200009411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secure-bt-homevoice01010120/home?authuser=8",nocase; classtype:attempted-recon; sid:200009412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secure-identy-pages/fbs-centers",nocase; classtype:attempted-recon; sid:200009413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securebt-bill/bt",nocase; classtype:attempted-recon; sid:200009414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securebtoffice/bt",nocase; classtype:attempted-recon; sid:200009415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securebtweebly/bt",nocase; classtype:attempted-recon; sid:200009416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securemybills/bt",nocase; classtype:attempted-recon; sid:200009417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securemybt/bt",nocase; classtype:attempted-recon; sid:200009418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securemylogin/bt",nocase; classtype:attempted-recon; sid:200009419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secureoffice/bt",nocase; classtype:attempted-recon; sid:200009420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securiplus0101/accueil",nocase; classtype:attempted-recon; sid:200009421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/seqbt/bt",nocase; classtype:attempted-recon; sid:200009422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/serveur-communication-box/accueil",nocase; classtype:attempted-recon; sid:200009423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/serveur-communication-pro/accueil",nocase; classtype:attempted-recon; sid:200009424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sghbjyx/btconnect",nocase; classtype:attempted-recon; sid:200009425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/shgeudh/home",nocase; classtype:attempted-recon; sid:200009426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/shootup/bt-business",nocase; classtype:attempted-recon; sid:200009427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/simpleswapofficialsite/home",nocase; classtype:attempted-recon; sid:200009428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/soeyankandi5/bt-business",nocase; classtype:attempted-recon; sid:200009429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/srghjkdsvxdfbv/btbusiness",nocase; classtype:attempted-recon; sid:200009430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/srtu5y4384rikq3892uq/office",nocase; classtype:attempted-recon; sid:200009431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/strtm-statr/strtym-statr?fbclid=iwar2z7e7ynueypheqdawlqj8xflososlpfqiskb5c2j3lhtn0j-dlmw5pkj0",nocase; classtype:attempted-recon; sid:200009432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/suoam/home",nocase; classtype:attempted-recon; sid:200009433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/surveypagelogin/home",nocase; classtype:attempted-recon; sid:200009434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/system-mobile-lock/view",nocase; classtype:attempted-recon; sid:200009435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/systemnewloginpage2021",nocase; classtype:attempted-recon; sid:200009436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/systemtonewpage2021",nocase; classtype:attempted-recon; sid:200009437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/szdgsdhgd",nocase; classtype:attempted-recon; sid:200009438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/t45t856tref2rvw/btconnect",nocase; classtype:attempted-recon; sid:200009439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/t7-qf3w4j987-59-572-7bt/bt",nocase; classtype:attempted-recon; sid:200009440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/t8uw85y348/btconnect",nocase; classtype:attempted-recon; sid:200009441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tbttbt/bt-business",nocase; classtype:attempted-recon; sid:200009442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tebgbu/bt",nocase; classtype:attempted-recon; sid:200009443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/terms-comunity-centers/page-verification",nocase; classtype:attempted-recon; sid:200009444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/terms-identyhelps/page-verifycation",nocase; classtype:attempted-recon; sid:200009445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/teteretejchhv/home",nocase; classtype:attempted-recon; sid:200009446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tr129/btconneccc",nocase; classtype:attempted-recon; sid:200009447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/transect/",nocase; classtype:attempted-recon; sid:200009448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/trbtbt/bt-business",nocase; classtype:attempted-recon; sid:200009449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/trjhhklfjzgujsumkgn-bt/office365",nocase; classtype:attempted-recon; sid:200009450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/trsrthhggfghj/home",nocase; classtype:attempted-recon; sid:200009451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ttbtbt/bt-home",nocase; classtype:attempted-recon; sid:200009452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tyfguikiugfedgbt/btconnect",nocase; classtype:attempted-recon; sid:200009453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/u5ut58euq2emuwdefrgv/btconnect",nocase; classtype:attempted-recon; sid:200009454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ugerfg5bv/bt",nocase; classtype:attempted-recon; sid:200009455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ugtdyguj/home",nocase; classtype:attempted-recon; sid:200009456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uiooioooi/home",nocase; classtype:attempted-recon; sid:200009457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uoiytrewsdfgfhjhkjn/office365",nocase; classtype:attempted-recon; sid:200009458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/updatenewaccess/home",nocase; classtype:attempted-recon; sid:200009459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrade-bt/home",nocase; classtype:attempted-recon; sid:200009460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrade-btbtbtb/bt-com",nocase; classtype:attempted-recon; sid:200009461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrading209/home",nocase; classtype:attempted-recon; sid:200009462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ustoan/home",nocase; classtype:attempted-recon; sid:200009463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/utututttu/home",nocase; classtype:attempted-recon; sid:200009464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/utyuouo/home",nocase; classtype:attempted-recon; sid:200009465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uyfyresfcgvjkl/home",nocase; classtype:attempted-recon; sid:200009466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uyowap/home",nocase; classtype:attempted-recon; sid:200009467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uyuytutytuy/home",nocase; classtype:attempted-recon; sid:200009468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/v5rx/bt-business",nocase; classtype:attempted-recon; sid:200009469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/va139/btcomms?authuser=1",nocase; classtype:attempted-recon; sid:200009470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/va779/btcomm?authuser=1",nocase; classtype:attempted-recon; sid:200009471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vbjgknkfnmdkgdbt/btconnect",nocase; classtype:attempted-recon; sid:200009472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vcvcvcvcvccv/home",nocase; classtype:attempted-recon; sid:200009473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vdffshpppeuejkilofeshesibe/home",nocase; classtype:attempted-recon; sid:200009474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vdrs/bt-business",nocase; classtype:attempted-recon; sid:200009475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/venmo-loginusa/",nocase; classtype:attempted-recon; sid:200009476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/verifyfdjkdbt/btconnect",nocase; classtype:attempted-recon; sid:200009477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/verizonupdateinfo/home",nocase; classtype:attempted-recon; sid:200009478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/veruuyiohfvdydy/home",nocase; classtype:attempted-recon; sid:200009479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vfbjf/btconnect",nocase; classtype:attempted-recon; sid:200009480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vgjg/bt-business",nocase; classtype:attempted-recon; sid:200009481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/view%20-your-bills/home",nocase; classtype:attempted-recon; sid:200009482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/view-btbilll/bt",nocase; classtype:attempted-recon; sid:200009483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/view-mobile/info",nocase; classtype:attempted-recon; sid:200009484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt-1/bt",nocase; classtype:attempted-recon; sid:200009485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt-1hgb/bt",nocase; classtype:attempted-recon; sid:200009486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt-1hgb/btyour",nocase; classtype:attempted-recon; sid:200009487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt1/bt",nocase; classtype:attempted-recon; sid:200009488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbillbtnow/bt",nocase; classtype:attempted-recon; sid:200009489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbtbillbusiness/btconnect",nocase; classtype:attempted-recon; sid:200009490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbtbusinessbill/btconnect",nocase; classtype:attempted-recon; sid:200009491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybill/btconnect",nocase; classtype:attempted-recon; sid:200009492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybt-/bt",nocase; classtype:attempted-recon; sid:200009493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybtbill-2/bt",nocase; classtype:attempted-recon; sid:200009494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewyournewbill/bt-business-btconnect",nocase; classtype:attempted-recon; sid:200009495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vjsdhdfidjasi/btconnect",nocase; classtype:attempted-recon; sid:200009496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vocalfixe/accueil",nocase; classtype:attempted-recon; sid:200009497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/voice-cloud-cloud/home?authuser=3",nocase; classtype:attempted-recon; sid:200009498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/voicenote-office365/home",nocase; classtype:attempted-recon; sid:200009499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vugbdhrei0iue4/bt",nocase; classtype:attempted-recon; sid:200009500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vvvccxcxmmllllakobadaba/home",nocase; classtype:attempted-recon; sid:200009501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vxvbcnmmvv/home",nocase; classtype:attempted-recon; sid:200009502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/w735utrfe928e32/bt",nocase; classtype:attempted-recon; sid:200009503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/watueru/bt-business",nocase; classtype:attempted-recon; sid:200009504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/webmail12bt/home",nocase; classtype:attempted-recon; sid:200009505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/webservice123/home",nocase; classtype:attempted-recon; sid:200009506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wefgb/bt",nocase; classtype:attempted-recon; sid:200009507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/werrttyuuu/home",nocase; classtype:attempted-recon; sid:200009508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wkkdbillz7z/bt-business",nocase; classtype:attempted-recon; sid:200009509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wnbhkfjfoie5ur9/office365",nocase; classtype:attempted-recon; sid:200009510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/workdmodecc/bt",nocase; classtype:attempted-recon; sid:200009511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wquer548658347bt/bt",nocase; classtype:attempted-recon; sid:200009512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wsdxcvvbnb/bt",nocase; classtype:attempted-recon; sid:200009513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/x0bt/bt-business",nocase; classtype:attempted-recon; sid:200009514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xcccjcdhasks/btconnect",nocase; classtype:attempted-recon; sid:200009515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xfinityupgrad/home?authuser=3",nocase; classtype:attempted-recon; sid:200009516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xfojnbvijozhd-mfjv-bt/office365",nocase; classtype:attempted-recon; sid:200009517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xinmywin/bt-business",nocase; classtype:attempted-recon; sid:200009518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xm58e0498rw3qu/bt",nocase; classtype:attempted-recon; sid:200009519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xmicrosoftoficew/home",nocase; classtype:attempted-recon; sid:200009520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xopauyr/home",nocase; classtype:attempted-recon; sid:200009521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xsuooma/bt-business",nocase; classtype:attempted-recon; sid:200009522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xu7opa/home",nocase; classtype:attempted-recon; sid:200009523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xuaok/home",nocase; classtype:attempted-recon; sid:200009524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xuaopm/home",nocase; classtype:attempted-recon; sid:200009525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xuiona/home",nocase; classtype:attempted-recon; sid:200009526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xuopau/home",nocase; classtype:attempted-recon; sid:200009527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xvhfefef/bt-business",nocase; classtype:attempted-recon; sid:200009528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yah000/home",nocase; classtype:attempted-recon; sid:200009529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yah0o0/home",nocase; classtype:attempted-recon; sid:200009530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahho0o00o/home",nocase; classtype:attempted-recon; sid:200009531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yaho000/home",nocase; classtype:attempted-recon; sid:200009532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahoo0001/home",nocase; classtype:attempted-recon; sid:200009533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahood213/home",nocase; classtype:attempted-recon; sid:200009534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahoomaillpage/yahoo",nocase; classtype:attempted-recon; sid:200009535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahoomailwebbb/yahoo",nocase; classtype:attempted-recon; sid:200009536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahooserviceess02/yahoo-com",nocase; classtype:attempted-recon; sid:200009537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahooserviiicee/yahoo",nocase; classtype:attempted-recon; sid:200009538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yanyan7/bt-business",nocase; classtype:attempted-recon; sid:200009539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yktvyessir/bt-business",nocase; classtype:attempted-recon; sid:200009540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ymaiiil109/",nocase; classtype:attempted-recon; sid:200009541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yorku-ca-hayford",nocase; classtype:attempted-recon; sid:200009542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/youronlneserviceinfo/home?authuser=6",nocase; classtype:attempted-recon; sid:200009543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ypapaloasssspp/home",nocase; classtype:attempted-recon; sid:200009544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yryrtrtrt/home",nocase; classtype:attempted-recon; sid:200009545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yt-ty/home",nocase; classtype:attempted-recon; sid:200009546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yt89ougjio/bt",nocase; classtype:attempted-recon; sid:200009547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ytesdfxfgvjikjnm/bt",nocase; classtype:attempted-recon; sid:200009548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yyuyyiu/home",nocase; classtype:attempted-recon; sid:200009549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zsgkjdhgjitjgbnzl/office365",nocase; classtype:attempted-recon; sid:200009550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zuoamu/home",nocase; classtype:attempted-recon; sid:200009551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zxchooloshi/bt",nocase; classtype:attempted-recon; sid:200009552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zxcvbnmjkhsdfghj/home",nocase; classtype:attempted-recon; sid:200009553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zyuoak/home",nocase; classtype:attempted-recon; sid:200009554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skrtysupport.com",nocase; http_uri; content:"/home/login.php",nocase; classtype:attempted-recon; sid:200009555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=http://taijishentie.com/js/index.htm?http://us.battle.net/login/en/?ref=http://xwnrssfus.battle.net/d3/en/index&amp\;app=com-d3",nocase; classtype:attempted-recon; sid:200009556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=https://bit.ly/3lefgwg",nocase; classtype:attempted-recon; sid:200009557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=https://dhtgfhxfgs.com/doc",nocase; classtype:attempted-recon; sid:200009558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartklick.biz",nocase; http_uri; content:"/?p=gntdomrwme5gi3bpge3temry",nocase; classtype:attempted-recon; sid:200009559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartsparksolutions.com",nocase; http_uri; content:"/2018/postmaster/postmaster/china/index.php?email=yang.hu@worldquant.com",nocase; classtype:attempted-recon; sid:200009560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-support.com",nocase; http_uri; content:"/client/index.html",nocase; classtype:attempted-recon; sid:200009561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-support.com",nocase; http_uri; content:"/php/api/jump.php",nocase; classtype:attempted-recon; sid:200009562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smpn4gusel-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/gov_noreply-mail_smartidenty_com/eql7oyg7c2tgjdhty6xirlwb50f2xrwf7nxkm-wznhvhdw?e=4%3al2v0yi&at=9",nocase; classtype:attempted-recon; sid:200009563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smpn4gusel-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/gov_noreply-mail_spherly1_com/ee8q2ogktlbpraupvertxzab4b-dfxjs7vgbph7gmiekqa?e=4%3a1v8swu&at=9",nocase; classtype:attempted-recon; sid:200009564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smpn4gusel-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/gov_noreply-mail_tahonadegabino_com/eao71zn7oahhpovxhdarvbybo2iw56rh-qgxlkjnj0plvq?e=4%3aysoji5&at=9",nocase; classtype:attempted-recon; sid:200009565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smpn4gusel-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/gov_noreply-mail_tuplazoleta_com/eyrvhjxuxgncui-esnrdi3wbxp2a08kunqm9ip_r0ptyxa?e=4%3an6lcvg&at=9",nocase; classtype:attempted-recon; sid:200009566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsaec-my.sharepoint.com",nocase; http_uri; content:"/:x:/g/personal/jblanquart_solutions-aec_com/eco5jmdevefltbrj2rnwypgbnoisgm3og8kg4u7uxbmefa?e=rge5mf",nocase; classtype:attempted-recon; sid:200009567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsaec-my.sharepoint.com",nocase; http_uri; content:"/personal/jblanquart_solutions-aec_com/_layouts/15/doc2.aspx?sourcedoc={602639ca-54c4-4b41-b41a-c9dab9d66298}&amp\;action=default&amp\;slrid=e91ed59f-406c-c000-3041-75a88e0b5689&amp\;originalpath=ahr0chm6ly9zb2x1dglvbnnhzwmtbxkuc2hhcmvwb2ludc5jb20vong6l2cvcgvyc29uywwvamjsyw5xdwfydf9zb2x1dglvbnmtywvjx2nvbs9fy281sm1ervzfrkx0qnjkmnjuv1lwz0jut0ltr20zb0c4a0c0vtd1wejnruzbp3j0aw1lpvlwvu1lrkezmlvn&amp\;cid=abd2b9bf-cc2a-4d1b-b944-a06977d53e19",nocase; classtype:attempted-recon; sid:200009568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spikenow.com",nocase; http_uri; content:"/collab/?id=bhyaaypay0mizbywaw0ockqgxxza6tjjy0mveuavwj6",nocase; classtype:attempted-recon; sid:200009569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-daten-management.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-daten-management.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-daten-management.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanagement.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanagement.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanagement.com",nocase; http_uri; content:"/qhtdfiuvci?3qrebexo4zlj",nocase; classtype:attempted-recon; sid:200009575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanagement.com",nocase; http_uri; content:"/qhtdfiuvci?9bsfw67gi1dn",nocase; classtype:attempted-recon; sid:200009576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenmanagement.com",nocase; http_uri; content:"/qhtdfiuvci?kncrxa34jyju",nocase; classtype:attempted-recon; sid:200009577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-erneuerungs-management.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-erneuerungsmanagement.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-erneuerungsmanagement.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-filial-management.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-filial-management.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-filial-support.com",nocase; http_uri; content:"/mg7t7qo14x",nocase; classtype:attempted-recon; sid:200009583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheits-management.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheits-management.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheits-management.com",nocase; http_uri; content:"/k407rvj0xi",nocase; classtype:attempted-recon; sid:200009586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheits-management.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheitsmanagement.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheitsmanagement.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungsmanagement.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungsmanagement.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungsmanagement.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherungsmanagement.com",nocase; http_uri; content:"/rnigebg9qy",nocase; classtype:attempted-recon; sid:200009593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungs-management.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungs-management.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungsmanagement.com",nocase; http_uri; content:"/0nz6so52ae",nocase; classtype:attempted-recon; sid:200009596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungsmanagement.com",nocase; http_uri; content:"/a0xshcea09",nocase; classtype:attempted-recon; sid:200009597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungsmanagement.com",nocase; http_uri; content:"/jd67890ef5",nocase; classtype:attempted-recon; sid:200009598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-umstellungsmanagement.com",nocase; http_uri; content:"/nk7s87cwxh",nocase; classtype:attempted-recon; sid:200009599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-update-support.com",nocase; http_uri; content:"/l65i1ym0tc",nocase; classtype:attempted-recon; sid:200009600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084",nocase; classtype:attempted-recon; sid:200009601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084/",nocase; classtype:attempted-recon; sid:200009602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200009603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx?guestaccesstoken=pv890fkaw3j3sxii8ccetsfxta1sij%2fjet9rdeg8oow%3d&docid=1_1c7b4face5780498ab995b86b5b2dcaff&wdformid=%7bbc8906f7%2d715e%2d4df9%2d8716%2d058d26a1426c%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200009605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx?guestaccesstoken=pv890fkaw3j3sxii8ccetsfxta1sij%2fjet9rdeg8oow%3d&docid=1_1c7b4face5780498ab995b86b5b2dcaff&wdformid=%7bbc8906f7%2d715e%2d4df9%2d8716%2d058d26a1426c%7d&action=formsubmit&cid=875889c4-4530-43af-a869-cf468b381692",nocase; classtype:attempted-recon; sid:200009606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe2.aspx?",nocase; classtype:attempted-recon; sid:200009607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starplanet.com.my",nocase; http_uri; content:"/plugins/october/load.php?0=a2luzy5rb25nqgdtywlslmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200009608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static01-raknensmit.com",nocase; http_uri; content:"/new_bgc/cell_padding.php",nocase; classtype:attempted-recon; sid:200009609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static02-raknensmit.com",nocase; http_uri; content:"/?vpass=step666",nocase; classtype:attempted-recon; sid:200009610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steinercoza-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9",nocase; classtype:attempted-recon; sid:200009611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stephensfloorcovering-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/p/river/etcsnshjyjrjs6qjqznzgwkbqbnrsyvaktfk83k31llxfa?e=4:gr4asj&amp\;at=9",nocase; classtype:attempted-recon; sid:200009612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com",nocase; classtype:attempted-recon; sid:200009613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman.html",nocase; classtype:attempted-recon; sid:200009614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman2.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/acc03lzzl4m3izm03iauserpowa.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200009617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/anaagc040gdyacgd0dyuser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com",nocase; classtype:attempted-recon; sid:200009619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com",nocase; classtype:attempted-recon; sid:200009620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/clientid4dunptjlryzrift3nrlomi160gqntzgznajujcnbszq8w/index.htm",nocase; classtype:attempted-recon; sid:200009621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200009622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com",nocase; classtype:attempted-recon; sid:200009623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/gu1r0utjruhjkukrxhauser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/indettn/oscman3.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/indettn/pdflmanco.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200009627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com",nocase; classtype:attempted-recon; sid:200009628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/",nocase; classtype:attempted-recon; sid:200009629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/index.html#martin.manasek@ruk.cuni.cz",nocase; classtype:attempted-recon; sid:200009630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/donperezbigsam.html#@yorku.ca",nocase; classtype:attempted-recon; sid:200009631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200009632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/newmineindex.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/noomooonplotoon-ogt0098709lot/mlindex.html#user@domain.org",nocase; classtype:attempted-recon; sid:200009634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200009635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/projerroro0h5j5ro0jrrj.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/q90qqqar22r229r292euser.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200009637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/q90qqqar22r229r292euser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/r0090a0p0090pb0ppba9owan.appspot.com/index.html#a@b.com",nocase; classtype:attempted-recon; sid:200009639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/rrdar99rt9qraraq99euser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/s0pts0apttxpp00atarrauth.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200009641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html",nocase; classtype:attempted-recon; sid:200009642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/sydlasgendomain.html#winnie@soupro.com",nocase; classtype:attempted-recon; sid:200009643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user517497679326978.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200009644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200009645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/xzrdzcdruerp.appspot.com/index.html#ricardo.rodriguez@cgexchange.org",nocase; classtype:attempted-recon; sid:200009646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com",nocase; classtype:attempted-recon; sid:200009647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/1827435283/1827435283.html",nocase; classtype:attempted-recon; sid:200009648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/advertorial010/789654nu57r.html",nocase; classtype:attempted-recon; sid:200009649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/awydjhabjcakucajjbhsa7.appspot.com/eafdcas/kakvajdbvkjdbadvujk.html",nocase; classtype:attempted-recon; sid:200009650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bbss-urltest-public/docomo_20210910_01.html",nocase; classtype:attempted-recon; sid:200009651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/buckettt01/redirect%20newslettersreply.shop.html#rd/u8888idsyy65301cvmt1247244psw23077wujo1715",nocase; classtype:attempted-recon; sid:200009652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/document-check/sign.html",nocase; classtype:attempted-recon; sid:200009653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=identitytheft@legalshield.com",nocase; classtype:attempted-recon; sid:200009654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@domain.ch",nocase; classtype:attempted-recon; sid:200009655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@example.org",nocase; classtype:attempted-recon; sid:200009656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ertyrtyertyertyretyertyr/",nocase; classtype:attempted-recon; sid:200009657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/felix_draw/sanday.html",nocase; classtype:attempted-recon; sid:200009658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/felix_draw/sanday.html#yyy.aspx?fndfdvccgxszcxb1dcdcsrcjc1f7qd96fcbbb43",nocase; classtype:attempted-recon; sid:200009659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/h6fg4ft78/556666%20(2).html",nocase; classtype:attempted-recon; sid:200009660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/hmosrwfggcwzbcyjpndfmmzbpmaxzdiq/yrtyrhgfghvhgftrytdfghchgrtyfghcvghfhgdw.html",nocase; classtype:attempted-recon; sid:200009661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#cl/13669_md/1/788/1401/22/1025434",nocase; classtype:attempted-recon; sid:200009662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#cl/13695_md/1/788/1401/109/376564",nocase; classtype:attempted-recon; sid:200009663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#un/13664_md/1/455/1401/112/814109",nocase; classtype:attempted-recon; sid:200009664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#un/13695_md/1/788/1401/25/339407",nocase; classtype:attempted-recon; sid:200009665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inks87/ink8899.html",nocase; classtype:attempted-recon; sid:200009666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/navy/nfcu.htm",nocase; classtype:attempted-recon; sid:200009667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ngicwagnbntzrwhnkodcqgicigddbzkl/yrtyrhyhghsfgfzrzpoiortyfghcvghfhgdw.html",nocase; classtype:attempted-recon; sid:200009668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ntwe4nkt4e.appspot.com/20770.html",nocase; classtype:attempted-recon; sid:200009669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/otlinks/trafrp.html",nocase; classtype:attempted-recon; sid:200009670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/prgxsqydsktkvzgnkrnhyrmwewzmfnd/yturfggtrefgfkuhfddpoicfwrtetyrtfseuytrw.html",nocase; classtype:attempted-recon; sid:200009671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/regularizeambiente/acesso.html",nocase; classtype:attempted-recon; sid:200009672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/segurocomcliente/acesso.html",nocase; classtype:attempted-recon; sid:200009673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/submitpayer5/index.html",nocase; classtype:attempted-recon; sid:200009674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/submitpayer7/index.html",nocase; classtype:attempted-recon; sid:200009675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/submitpaymentrefundid8324/index.html",nocase; classtype:attempted-recon; sid:200009676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/y4k74ppt9egnm24wmcx9p6n7h4khgzq2/proqjsvb5mzs5mzvins/qr72vvf7fpahbrsaa0x.html#cl/0_mt/1/112/495/213654/0",nocase; classtype:attempted-recon; sid:200009677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redireck.html",nocase; classtype:attempted-recon; sid:200009678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redirecvxxx.html",nocase; classtype:attempted-recon; sid:200009679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redplan.html",nocase; classtype:attempted-recon; sid:200009680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/zloogqmltxvgfjbtlbfvuoewunkzscyr/ytrtyrcgfserdffeaezddfyiouiuyutytrw.html",nocase; classtype:attempted-recon; sid:200009681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.ning.com",nocase; http_uri; content:"/topology/rest/1.0/file/get/8122054091/",nocase; classtype:attempted-recon; sid:200009682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation",nocase; classtype:attempted-recon; sid:200009683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/",nocase; classtype:attempted-recon; sid:200009684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php",nocase; classtype:attempted-recon; sid:200009685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&amp\;id=67f44f34b1007a28ef8be6ac1ef336c867f44f34b1007a28ef8be6ac1ef336c8&amp\;session=67f44f34b1007a28ef8be6ac1ef336c867f44f34b1007a28ef8be6ac1ef336c8",nocase; classtype:attempted-recon; sid:200009686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&id=666086fc9b4d91c39a0d03e11816dd1c666086fc9b4d91c39a0d03e11816dd1c&session=666086fc9b4d91c39a0d03e11816dd1c666086fc9b4d91c39a0d03e11816dd1c",nocase; classtype:attempted-recon; sid:200009687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&id=c2ce40f177bea74a0727867fafcbc454c2ce40f177bea74a0727867fafcbc454&session=c2ce40f177bea74a0727867fafcbc454c2ce40f177bea74a0727867fafcbc454",nocase; classtype:attempted-recon; sid:200009688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stratoitgroup-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/chantelle_labuschagne_stratoitgroup_co_za/eeb81yzshl1fkzxbwee6cnwbxog8g35tchcuwsoywnjgdq?e=4:ilceuq&amp\;at=9",nocase; classtype:attempted-recon; sid:200009689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"structin-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/p_brouwer_structin_nl/ehu4nhcxmmlmrmou4we1fpsb5lqpufe4sslse_xjh33dea?e=9dtcpc",nocase; classtype:attempted-recon; sid:200009690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"studentsimperial-my.sharepoint.com",nocase; http_uri; content:"/personal/vcarrion_students_imperial_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=rvz44awzcpdubusreabukfouvj04snc94kmlpod04h4%3d&amp\;docid=1_1acb4510b85ac413f9ea166e72d4bbca4&amp\;wdformid=%7b3cad2e15%2d9297%2d423e%2d87b0%2db890b72dfaa2%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200009691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"studentsimperial-my.sharepoint.com",nocase; http_uri; content:"/personal/vcarrion_students_imperial_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=rvz44awzcpdubusreabukfouvj04snc94kmlpod04h4%3d&docid=1_1acb4510b85ac413f9ea166e72d4bbca4&wdformid=%7b3cad2e15%2d9297%2d423e%2d87b0%2db890b72dfaa2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"styleshift.com",nocase; http_uri; content:"/wp-admin/meta/carolinamrod/melis/",nocase; classtype:attempted-recon; sid:200009693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suivi-coupon-recharge.blogspot.com",nocase; http_uri; content:"/p/authentifier-transcash.html",nocase; classtype:attempted-recon; sid:200009694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumeret.com",nocase; http_uri; content:"/wp.chinadomin/china/?login=replaced@us.sika.com&amp\;mc_phishing_protection_id=28396-c4a8rukna38tf30kt56g",nocase; classtype:attempted-recon; sid:200009695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumeret.com",nocase; http_uri; content:"/wp.chinadomin/china?login=replaced@us.sika.com&amp\;mc_phishing_protection_id=28396-c4a8rukna38tf30kt56g",nocase; classtype:attempted-recon; sid:200009696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunypotsdam-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/caniasj_potsdam_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=3iraoz5qrcw0w4%2frehotcj25mgvldlzenlokue%2bfudw%3d&docid=1_10850bdc012e8450fb8f3297a80b3ecbb&wdformid=%7b955fb703-afe5-44b1-b0ca-d52fccb3199c%7d&action=formsubmit&cid=5df7ddf9-38f3-4abe-b529-7a3c4779e246",nocase; classtype:attempted-recon; sid:200009697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superpark-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200009698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-reclaimeconomichelp.blogspot.com",nocase; http_uri; content:"/?x1",nocase; classtype:attempted-recon; sid:200009699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5e23c40fb533f62621f5252d#form/0",nocase; classtype:attempted-recon; sid:200009700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5e5b8d772e417841d96ee7af#form/0",nocase; classtype:attempted-recon; sid:200009701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5f7840827687c759eed006a1#welcome",nocase; classtype:attempted-recon; sid:200009702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/608bca7586919c70a2066ef7",nocase; classtype:attempted-recon; sid:200009703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a058fc9006c7136837a91d#welcome",nocase; classtype:attempted-recon; sid:200009704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a94371b2b62b3fc765f8d6#form/0",nocase; classtype:attempted-recon; sid:200009705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a965d7f248866d4bfaa2e1",nocase; classtype:attempted-recon; sid:200009706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60b6ccf8f448b239642ef416#welcome",nocase; classtype:attempted-recon; sid:200009707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877",nocase; classtype:attempted-recon; sid:200009708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877#form/0",nocase; classtype:attempted-recon; sid:200009709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c1eb6bda9e5d578a03ff44#welcome",nocase; classtype:attempted-recon; sid:200009710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c7e129d519fc79691fa39e#welcome",nocase; classtype:attempted-recon; sid:200009711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c9c5d0f448b2396441605e#form/0",nocase; classtype:attempted-recon; sid:200009712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60e16548acc3670c142bc20f",nocase; classtype:attempted-recon; sid:200009713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60f4eb89eec7723cc29b78c0",nocase; classtype:attempted-recon; sid:200009714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60f4eb89eec7723cc29b78c0#form/0",nocase; classtype:attempted-recon; sid:200009715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#form/0",nocase; classtype:attempted-recon; sid:200009716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#welcome",nocase; classtype:attempted-recon; sid:200009717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveylegend.com",nocase; http_uri; content:"/s/2vze",nocase; classtype:attempted-recon; sid:200009718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svkmmumbai-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pranjali_chandurkar_nmims_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=668cyp4s%2fwcmx8rj223bvjfwdvtryffzfpyarbrueha%3d&amp\;docid=1_1916b69db182644fead12e874cad930c4&amp\;wdformid=%7bcd4093b9%2ddfae%2d49f1%2dadde%2df32fbe93b271%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200009719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscoat.com.cn",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200009720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw",nocase; classtype:attempted-recon; sid:200009721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw/",nocase; classtype:attempted-recon; sid:200009722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.si/",nocase; classtype:attempted-recon; sid:200009723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synapse-project.com",nocase; http_uri; content:"/about-us/netflix/9001ca429212011f4a4fda6c778cc318/account",nocase; classtype:attempted-recon; sid:200009724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synapse-project.com",nocase; http_uri; content:"/about-us/netflix/9001ca429212011f4a4fda6c778cc318/account/",nocase; classtype:attempted-recon; sid:200009725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/4idnrqspjc?amp=1",nocase; classtype:attempted-recon; sid:200009726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bez0scjtp9?amp=1?id=htgsjhisuu",nocase; classtype:attempted-recon; sid:200009727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bznnttpwyc?amp=1?trackingid=lhgy4czf&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200009728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/egwwg2u26h?amp=1",nocase; classtype:attempted-recon; sid:200009729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/gkg8qifan6",nocase; classtype:attempted-recon; sid:200009730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk",nocase; classtype:attempted-recon; sid:200009731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk?amp=1?trackingid=ncpvnlmx&signature=newsletter",nocase; classtype:attempted-recon; sid:200009732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=duv7ggf5&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200009733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=upvqjzrm&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200009734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=v3hqk4lo&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200009735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/kulije4pg6",nocase; classtype:attempted-recon; sid:200009736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/mo6udulxss?amp=1",nocase; classtype:attempted-recon; sid:200009737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/pguwj7knxb?amp=1",nocase; classtype:attempted-recon; sid:200009738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/pidf3lkzfq?amp=1",nocase; classtype:attempted-recon; sid:200009739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/tjdzhdoq45?amp=1",nocase; classtype:attempted-recon; sid:200009740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/tx754h8epe?amp=1",nocase; classtype:attempted-recon; sid:200009741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/vq4q53mozw?amp=1",nocase; classtype:attempted-recon; sid:200009742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/xysalvvopk?amp=1",nocase; classtype:attempted-recon; sid:200009743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/zrd6j5rq4u?amp=1",nocase; classtype:attempted-recon; sid:200009744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ztbmd7lz26?amp=1?apply=klauricella",nocase; classtype:attempted-recon; sid:200009745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mail-svc.evernote.com",nocase; http_uri; content:"/f/a/7vnazmxjrqjeu2yhcuso2a~~/aadd_wa~/rgri2drap0qxahr0chm6ly9rbm93bgvkz2vhbmr0cmfpbmluzy5jb20vbwvkymlsbhnwyxkymdixl1cdc3bjqgpg9dq19wcmnbtxuhptyw50b3zhbmkuyw5kcmvhqgdtywlslmnvbvgeaaaabg~~",nocase; classtype:attempted-recon; sid:200009746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.marketing1.william-reed.com",nocase; http_uri; content:"/r/?id=h4b503239,418a056e,416f6e60",nocase; classtype:attempted-recon; sid:200009747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamtest.com",nocase; http_uri; content:"/alibabapassport/ali2020/login.htm",nocase; classtype:attempted-recon; sid:200009748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tawk.link",nocase; http_uri; content:"/5e9f607835bcbb0c9ab3656a/t/new-ticket/d3e5f86dddb76aaf581d0c09b5b91b2c034004c0/task_payment_doe1.pdf",nocase; classtype:attempted-recon; sid:200009749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcta-my.sharepoint.com",nocase; http_uri; content:"/:w:/g/personal/covid_tcta_co_za1/ebjxoc27czhhowhytqdp-3ibzjxhp5dd9_a-vm8e5vzs0a?e=tehygt",nocase; classtype:attempted-recon; sid:200009750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamgrouppcl-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/nongluck_m_attconsult_com/eumhzaoxwpngi0mled8_gs0blnumsbrsk_gjzqcnte543g?download=1&amp\;utm_content=newclient&amp\;utm_campaign=website&amp\;utm_source=julywazepromo&amp\;utm_medium=email",nocase; classtype:attempted-recon; sid:200009751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecsuport.com.br",nocase; http_uri; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html",nocase; classtype:attempted-recon; sid:200009752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telegra.ph",nocase; http_uri; content:"/pua-10-09",nocase; classtype:attempted-recon; sid:200009753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telenorkandklimsupoort.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post_48.html",nocase; classtype:attempted-recon; sid:200009754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"termerosapepe.it",nocase; http_uri; content:"/soitj/",nocase; classtype:attempted-recon; sid:200009755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test102760.test-account.com",nocase; http_uri; content:"/at&t-login.htm",nocase; classtype:attempted-recon; sid:200009756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test103126.test-account.com",nocase; http_uri; content:"/at&t-login.htm",nocase; classtype:attempted-recon; sid:200009757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedigirocket.com",nocase; http_uri; content:"/wp-content/plugins/form.htm",nocase; classtype:attempted-recon; sid:200009758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themarbleshop.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=b0tjq7uw13ohhsvlvr6vq189xb2ed7p3yoiuxgzs5xu%3d&amp\;docid=1_127b97513b5664db7a2c23beec6cbdf50&amp\;wdformid=%7b8bd84c70-967f-4172-8b3b-973c5f74f5a8%7d&amp\;action=formsubmit&amp\;cid=18e6e320-2aeb-4aa0-befe-ed946b2e8bd0",nocase; classtype:attempted-recon; sid:200009759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therxreview.com",nocase; http_uri; content:"/adminchs/chase",nocase; classtype:attempted-recon; sid:200009760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therxreview.com",nocase; http_uri; content:"/adminchs/chase/surf4.php",nocase; classtype:attempted-recon; sid:200009761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therxreview.com",nocase; http_uri; content:"/oneddrive",nocase; classtype:attempted-recon; sid:200009762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therxreview.com",nocase; http_uri; content:"/oneddrive/",nocase; classtype:attempted-recon; sid:200009763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiny.one",nocase; http_uri; content:"/mj76nxhf",nocase; classtype:attempted-recon; sid:200009764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/0nlinelbk",nocase; classtype:attempted-recon; sid:200009765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/22yhxjfm",nocase; classtype:attempted-recon; sid:200009766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/32pxt5ya",nocase; classtype:attempted-recon; sid:200009767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/34tp94s2",nocase; classtype:attempted-recon; sid:200009768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/3j3k2mzd",nocase; classtype:attempted-recon; sid:200009769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/3tewdjns",nocase; classtype:attempted-recon; sid:200009770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/45v6f2np",nocase; classtype:attempted-recon; sid:200009771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/48rzxpne",nocase; classtype:attempted-recon; sid:200009772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/5mhr8xz2",nocase; classtype:attempted-recon; sid:200009773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/6v2jmdc",nocase; classtype:attempted-recon; sid:200009774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/9b5d89ww",nocase; classtype:attempted-recon; sid:200009775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/b8wjtbep",nocase; classtype:attempted-recon; sid:200009776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/btinternet56",nocase; classtype:attempted-recon; sid:200009777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/di9mnobebi",nocase; classtype:attempted-recon; sid:200009778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/evyu688y",nocase; classtype:attempted-recon; sid:200009779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/fxyjskkc",nocase; classtype:attempted-recon; sid:200009780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/kdtvp",nocase; classtype:attempted-recon; sid:200009781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/lbkcanaldigital",nocase; classtype:attempted-recon; sid:200009782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/m6t9puyd",nocase; classtype:attempted-recon; sid:200009783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/n2p8adtb?email=ndanatsei.nyamhunga@sc.comorganization",nocase; classtype:attempted-recon; sid:200009784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/nycgovtgrant",nocase; classtype:attempted-recon; sid:200009785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/relief-for-pandemic",nocase; classtype:attempted-recon; sid:200009786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/sd9t35n/?cliente=multiconexoes@terra.com.br/jhyyw8hlac3s5ao9r7mr22fe/imprimir.cgi",nocase; classtype:attempted-recon; sid:200009787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/toqjl4j/?email=firstregistration6@dvla.gov.uk",nocase; classtype:attempted-recon; sid:200009788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/x7kfywy7",nocase; classtype:attempted-recon; sid:200009789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/y2czr3ag",nocase; classtype:attempted-recon; sid:200009790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/y3xk7mt7/",nocase; classtype:attempted-recon; sid:200009791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yhgdwa3h",nocase; classtype:attempted-recon; sid:200009792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yk7xfpss",nocase; classtype:attempted-recon; sid:200009793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/ymup2zv9",nocase; classtype:attempted-recon; sid:200009794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxb48kqj",nocase; classtype:attempted-recon; sid:200009795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxry9vf5",nocase; classtype:attempted-recon; sid:200009796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yyvm8qr5",nocase; classtype:attempted-recon; sid:200009797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/zcsy4w4p",nocase; classtype:attempted-recon; sid:200009798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokenwalletconnect.com",nocase; http_uri; content:"/registry/connect/index.html",nocase; classtype:attempted-recon; sid:200009799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tr.im",nocase; http_uri; content:"/alertaslbcp",nocase; classtype:attempted-recon; sid:200009800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"track.adform.net",nocase; http_uri; content:"/c/?bn=35405429\;cpdir=https://tmmny.csb.app/.wewrewew.ahr0chm6ly9pbnzlc3rpbmdpbmdvzc5vcmcvqvbjmjq3.yw1izxiuzml0dg9uqhnwyxjrlmnvlm56",nocase; classtype:attempted-recon; sid:200009801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transcash-fr-v.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200009802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?_t=1527230263291&amp\;from=en&amp\;notrans=0&amp\;query=&amp\;tabmode=1&amp\;tfr=englishpc&amp\;to=zh-chs&amp\;url=https://www.wellsfargo.com",nocase; classtype:attempted-recon; sid:200009803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?_t=1572026205262%20open_in_new%20add%20link&amp\;from=en&amp\;notrans=0&amp\;query=paypal%20account&amp\;tabmode=2&amp\;tfr=englishpc&amp\;to=zh-chs&amp\;url=https://www.paypal.com/us/signin",nocase; classtype:attempted-recon; sid:200009804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;n",nocase; classtype:attempted-recon; sid:200009805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;notrans=0&amp\;tfr=englishpc&amp\;from=en&amp\;to=zh-chs&amp\;securl=&amp\;_t=1572026205262%20open_in_new%20add%20link%20open_in_new%20add%20link",nocase; classtype:attempted-recon; sid:200009806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tregollsschool-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/dbullen_tregolls_cornwall_sch_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=4w7nbxyv%2be5q5h6ifvqsvt%2ba0azuzpfgpywxpwtq6mu%3d&amp\;docid=1_1114d83a63e0f489b93e746d8b241db70&amp\;wdformid=%7bfff4536c%2d404d%2d410d%2da3b7%2d4cc8a8841296%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200009807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonontario-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ed_triathlonontario_com/_layouts/15/wopiframe.aspx?guestaccesstoken=tx4pjpe6j3l456dw6h5p4rjclnpql4gy3umalpcsbgc%3d&docid=1_15c1c05a0348c406b917721edd22b400e&wdformid=%7b743b2d9a-465e-4a2d-a672-3b480e7184ff%7d&action=formsubmit&cid=2b766ac1-60f6-4883-8ff0-3a53524a1f1c",nocase; classtype:attempted-recon; sid:200009808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonontario-my.sharepoint.com",nocase; http_uri; content:"/personal/ed_triathlonontario_com/_layouts/15/wopiframe.aspx?guestaccesstoken=tx4pjpe6j3l456dw6h5p4rjclnpql4gy3umalpcsbgc%3d&docid=1_15c1c05a0348c406b917721edd22b400e&wdformid=%7b743b2d9a-465e-4a2d-a672-3b480e7184ff%7d&action=formsubmit&cid=2b766ac1-60f6-4883-8ff0-3a53524a1f1c",nocase; classtype:attempted-recon; sid:200009809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/32megq",nocase; classtype:attempted-recon; sid:200009810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/unrpgg",nocase; classtype:attempted-recon; sid:200009811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/wsddga",nocase; classtype:attempted-recon; sid:200009812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=e%2f5p4lmr7oxtbuuzst9ihpacebtz%2bhbogl5i950bhau%3d&docid=1_151b39d9e7dd54cfba500875349d3beb6&wdformid=%7bda6fcad9%2d9684%2d43af%2db959%2de2fa774eaba6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=h2b5qkvlooc%2bfvhpo6qkbxdfdzwzpa7doqhaikfrj08%3d&docid=1_1cab74931edec4bf39e6f4768e7830a02&wdformid=%7b6a702647%2db560%2d40c5%2d8890%2d109ec5ad9bc5%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=inau9tsjk5bvaoypx/gfkvgo0iz4rq47kvts4tkb8yq=&amp\;docid=1_19c7a48ea3a0448c78765a480857920f0&amp\;wdformid={d8f70a7d-4204-4a87-a88e-bad6b0e4129e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200009815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=uh9hjveaooebgqolme%2f5qft71pw2stg2ojiiqxebzce%3d&docid=1_11e28ca5d86c6416f926736ea3e8ad885&wdformid=%7b70256f91%2df178%2d4e5f%2d847a%2df748294a79c9%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-request.com",nocase; http_uri; content:"/lloyds/",nocase; classtype:attempted-recon; sid:200009817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-request.com",nocase; http_uri; content:"/lloyds/login.php",nocase; classtype:attempted-recon; sid:200009818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorisedpayeerequest.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200009819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unclaimed-moneysearch.com",nocase; http_uri; content:"/?pid=405&utm_source=405&utm_campaign=405&chk=1&cid=669ca57cbbc8475ba2314fd339e262c0",nocase; classtype:attempted-recon; sid:200009820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/mofiles/z1v17xnm2o211yxxs9qsg0kq.php?secure&share=5ii6i3161907542327469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa11",nocase; classtype:attempted-recon; sid:200009821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/oldfile/4ve4ydqk581f45nsvwwoshtu.php",nocase; classtype:attempted-recon; sid:200009822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/oldfile/proposal/common/?login.srf",nocase; classtype:attempted-recon; sid:200009823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/ues/swe/signln.php?email=nooruddin@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200009824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd&amp\;session=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd",nocase; classtype:attempted-recon; sid:200009825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929&amp\;session=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929",nocase; classtype:attempted-recon; sid:200009826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step2.php",nocase; classtype:attempted-recon; sid:200009827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step3.php",nocase; classtype:attempted-recon; sid:200009828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/xec/ain/excelz/bizmail.php?email=&amp\;.rand=13vqcr8bp0gud&amp\;lc=1033&amp\;id=64855&amp\;mkt=en-us&amp\;cbcxt=mai&amp\;snsc=1",nocase; classtype:attempted-recon; sid:200009829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniga.ac.id",nocase; http_uri; content:"/wptracking/tracking2/tracking/tracking.php",nocase; classtype:attempted-recon; sid:200009830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniquesexygirls.net",nocase; http_uri; content:"/cgi-bin/atc/out.cgi?id=19&u=http:/www.experiencebrettjackson.dreamhosters.com/wp-content/plugins/inc/.b6a0e0f97b98509200cbe8dc8a90813a/96478879526111436369212b881ee965/5efe4ee1cde8b3df84ef4dea939aa5b0/e4e1205f7238e90b308e29077e32e81a473fe78d/db43c8397d81b9af8eeefc39b3ce1d77aa6e7ad9/e3f74ab593863dfc0ac6cd4216b662149754a5ab/1c51f70a771f31724e803a541e6aa7ad1f412527/e4458c837adb31b10124b969de4c8f73b5be8c01/",nocase; classtype:attempted-recon; sid:200009831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unrecognisedpayeerequest.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200009832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unrecognisedpayeerequest.com",nocase; http_uri; content:"/lloyds/login.php",nocase; classtype:attempted-recon; sid:200009833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unsub.listhandlr.com",nocase; http_uri; content:"/?email=#email#",nocase; classtype:attempted-recon; sid:200009834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uofc-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/arnuv_mayank1_ucalgary_ca/evgtz_pcletgonwkwyagc0wbkezwceoq_0hzi8h3ezxpnw",nocase; classtype:attempted-recon; sid:200009835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upconcretepipe-my.sharepoint.com",nocase; http_uri; content:"/personal/sdelaire_upconcretepipe_net/_layouts/15/doc.aspx?sourcedoc=%7b01466817-0a09-49f7-a646-12f1a7f04b1e%7d&amp\;action=default&amp\;slrid=454fdf9f-10c9-c000-5b23-b65ba66f4b23&amp\;originalpath=ahr0chm6ly91cgnvbmnyzxrlcglwzs1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9zzgvsywlyzv91cgnvbmnyzxrlcglwzv9uzxqvrwhkb1jnrupddmrkcgtzuzhhzndtedrcndc1bdv2bkhlamxsa25umwfllxvmzz9ydgltzt1rr2gxavrcutjvzw&amp\;cid=fc47738a-755f-4d0b-b2ae-453938c9b41a",nocase; classtype:attempted-recon; sid:200009836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uqr.to",nocase; http_uri; content:"/kr14?userid=1401523827",nocase; classtype:attempted-recon; sid:200009837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"url.gratis",nocase; http_uri; content:"/0lxgmv",nocase; classtype:attempted-recon; sid:200009838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dfsg",nocase; classtype:attempted-recon; sid:200009839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us6.list-manage.com",nocase; http_uri; content:"/survey?u=a0de668519da12283a5dd2280&id=dcbef4991f&attribution=false&e=50fd152abb",nocase; classtype:attempted-recon; sid:200009840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vellingekommun-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/karin_strand_vellinge_se/egyldcpw7zzet71gx887vwobrnhahqfmwqw5rejh4cib9a?e=sdoqrc",nocase; classtype:attempted-recon; sid:200009841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp",nocase; classtype:attempted-recon; sid:200009842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/",nocase; classtype:attempted-recon; sid:200009843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/2277e0f3c4c5c98e848c0e64d76d6fb5/",nocase; classtype:attempted-recon; sid:200009844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/d03ef074f8887403b084d613916df607/",nocase; classtype:attempted-recon; sid:200009845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/d4810797ed4ec28eeb047934428f14a1/",nocase; classtype:attempted-recon; sid:200009846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vetsheart.com",nocase; http_uri; content:"/verify/boi/authentication1.htm",nocase; classtype:attempted-recon; sid:200009847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viamobte.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post.html",nocase; classtype:attempted-recon; sid:200009848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.cc",nocase; http_uri; content:"/9mjize",nocase; classtype:attempted-recon; sid:200009849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?cc_key=&amp\;post=%7brandom_number_5%7d_1&amp\;to=http://18.118.206.123/index.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d",nocase; classtype:attempted-recon; sid:200009850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f13.77.220.204?key=07klc,email=briana.marrero@icloud.com&post=71837_1&cc_key",nocase; classtype:attempted-recon; sid:200009851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f13.77.220.204?key=a8umj",nocase; classtype:attempted-recon; sid:200009852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f13.77.220.204?key=v0t7j,email=daniellebradway@icloud.com&post=29563_1&cc_key",nocase; classtype:attempted-recon; sid:200009853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.117.100.58?key=jycoy",nocase; classtype:attempted-recon; sid:200009854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=1qg10",nocase; classtype:attempted-recon; sid:200009855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=3efeh",nocase; classtype:attempted-recon; sid:200009856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=cylqz",nocase; classtype:attempted-recon; sid:200009857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=dmyfj",nocase; classtype:attempted-recon; sid:200009858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=dvexh",nocase; classtype:attempted-recon; sid:200009859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=v0de0,email=kflove23@icloud.com&post=11981_1&cc_key",nocase; classtype:attempted-recon; sid:200009860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=zzbtj",nocase; classtype:attempted-recon; sid:200009861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.119.117.25?key=vaeao",nocase; classtype:attempted-recon; sid:200009862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.191.166.70?key=9kawg",nocase; classtype:attempted-recon; sid:200009863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.191.166.70?key=e2ede",nocase; classtype:attempted-recon; sid:200009864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.216.209.235?key=6v5vs",nocase; classtype:attempted-recon; sid:200009865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.216.209.235?key=ev56x",nocase; classtype:attempted-recon; sid:200009866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=u7tfm,email=resurgita@icloud.com&post=35252_1&cc_key",nocase; classtype:attempted-recon; sid:200009867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=vgy1e",nocase; classtype:attempted-recon; sid:200009868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.222.15.230?key=ol44d",nocase; classtype:attempted-recon; sid:200009869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f20.90.154.8/asu1",nocase; classtype:attempted-recon; sid:200009870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f3.144.230.232?key=pjttx,email=ahg_md_jd@me.com&post=81382_1&cc_key",nocase; classtype:attempted-recon; sid:200009871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f35.189.56.56?key=swddd,email=example@example.example&post=82401_1&cc_key",nocase; classtype:attempted-recon; sid:200009872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f35.189.56.56?key=wd3dp,email=aefay42@icloud.com&post=10925_1&cc_key",nocase; classtype:attempted-recon; sid:200009873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f35.229.41.22?key=ovyqo",nocase; classtype:attempted-recon; sid:200009874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f51.141.162.38?key=8fhcr",nocase; classtype:attempted-recon; sid:200009875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f52.14.205.198?key=1deex",nocase; classtype:attempted-recon; sid:200009876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f52.14.205.198?key=7qjpd",nocase; classtype:attempted-recon; sid:200009877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f52.14.205.198?key=elln0",nocase; classtype:attempted-recon; sid:200009878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f52.14.205.198?key=jav6v",nocase; classtype:attempted-recon; sid:200009879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f52.14.205.198?key=vca9m",nocase; classtype:attempted-recon; sid:200009880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2frajeshkhanal.com.np%2fwp-config.php&amp\;post=521188519_100&amp\;cc_key=",nocase; classtype:attempted-recon; sid:200009881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2frois-zkxzx.run.goorm.io/safe-browser/",nocase; classtype:attempted-recon; sid:200009882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http://18.117.221.246?key=yptju,email=example@example.example&post=91215_1&cc_key",nocase; classtype:attempted-recon; sid:200009883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyanux",nocase; classtype:attempted-recon; sid:200009884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyc8bd",nocase; classtype:attempted-recon; sid:200009885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyc8bd&post=665308711_37&cc_key",nocase; classtype:attempted-recon; sid:200009886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyejni&post=665308711_39&cc_key",nocase; classtype:attempted-recon; sid:200009887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fdropsite-redirect.com%2fses.php%2f5dshwyv&post=491077895_40&cc_key",nocase; classtype:attempted-recon; sid:200009888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fellenmedia.club%2fwp-admin%2fimages%2fq1&post=665308711_40&cc_key",nocase; classtype:attempted-recon; sid:200009889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2firs-pro.com%2fcovid%2fngiler%2fdata%2fasdasdassdasaas&post=665308711_18&cc_key",nocase; classtype:attempted-recon; sid:200009890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fonline.irs-confirmationus.com%2f%3fonline&post=491077895_14&cc_key",nocase; classtype:attempted-recon; sid:200009891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fonline.usprofile-irsconfirmation.com%2f%3fonline&post=491077895_27&cc_key",nocase; classtype:attempted-recon; sid:200009892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.compen-sation-irsprofile.com%2f%3fonline&post=491077895_31&cc_key",nocase; classtype:attempted-recon; sid:200009893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.direct-antidrop.com%2f&post=491077895_39",nocase; classtype:attempted-recon; sid:200009894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.irs-profilemanagement.com%2f%3fbee&post=491077895_19&cc_key",nocase; classtype:attempted-recon; sid:200009895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.irs-secconfirmation.com%2f%3fbee&post=491077895_18&cc_key",nocase; classtype:attempted-recon; sid:200009896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.profile-irsconfirmatin.com%2f%3fbee&post=491077895_17&cc_key",nocase; classtype:attempted-recon; sid:200009897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://arroketainsificansion.com/r/cairdiembos",nocase; classtype:attempted-recon; sid:200009898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://danbbq.com/?key",nocase; classtype:attempted-recon; sid:200009899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://drmustafaalagamy.com/css/rajahutandil2",nocase; classtype:attempted-recon; sid:200009900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://laprospergroup.com/wp-admin/assets/?key=8oyrd,email={email}",nocase; classtype:attempted-recon; sid:200009901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://notifyirsgovid.com/buletolol/gblk/covid/dashdkajshdaksjdhaskjdhaskjdhasdkl",nocase; classtype:attempted-recon; sid:200009902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://rendelparis.com/wp-admin/assets?key=isvbt,email={email}",nocase; classtype:attempted-recon; sid:200009903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://sahara-distribution.com/wp-admin/dir",nocase; classtype:attempted-recon; sid:200009904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://tourmenia.com/wp-admin/css/colors/midnight/rdr/?key=mhtov",nocase; classtype:attempted-recon; sid:200009905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://traffic-visitor.eng-us-claim-finance.com/r/umcsf3j",nocase; classtype:attempted-recon; sid:200009906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; http_uri; content:"/banks/firstdirect.com/",nocase; classtype:attempted-recon; sid:200009907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waaket.com",nocase; http_uri; content:"/wp-content/themes/1fq66tw",nocase; classtype:attempted-recon; sid:200009908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waaket.com",nocase; http_uri; content:"/wp-content/themes/1fq66tw/",nocase; classtype:attempted-recon; sid:200009909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_",nocase; classtype:attempted-recon; sid:200009910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_",nocase; classtype:attempted-recon; sid:200009911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_",nocase; classtype:attempted-recon; sid:200009912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warriorplus.com",nocase; http_uri; content:"/o2/a/f5s4y/0",nocase; classtype:attempted-recon; sid:200009913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watsontruck-my.sharepoint.com",nocase; http_uri; content:"/:w:/p/fsmith/eaquumvjy5bahivo2ewv-6ebebnpl4k8qd6onbtt3c-sgw?e=rzivtb",nocase; classtype:attempted-recon; sid:200009914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.serviceunit.co.uk",nocase; http_uri; content:"/upgrade/",nocase; classtype:attempted-recon; sid:200009915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d",nocase; classtype:attempted-recon; sid:200009916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/",nocase; classtype:attempted-recon; sid:200009917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wellingtoncloud-my.sharepoint.com",nocase; http_uri; content:"/personal/lynne_barron_eaglehouseschool_com/_layouts/15/wopiframe.aspx?guestaccesstoken=5r%2fl6nh%2bt0nfkb7xwynvz8n1wumz0wz%2fpwkgri5p6%2fs%3d&docid=1_192cb7c38faeb476cb58ce8f71598361c&wdformid=%7b3e42bd82%2db59e%2d403b%2d9998%2d0c2dd21bd5e6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200009918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wetransfer.cryptoappconnect.com",nocase; http_uri; content:"/?x1)",nocase; classtype:attempted-recon; sid:200009919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitefordkenworth-my.sharepoint.com",nocase; http_uri; content:"/personal/bwalters_lglk_com/_layouts/15/doc.aspx?sourcedoc={1d96cb1e-0031-41b8-8774-24bb2f7c4caa}&amp\;action=default&amp\;slrid=9ebb659f-7054-a000-b19b-7cb962889fc8&amp\;originalpath=ahr0chm6ly93agl0zwzvcmrrzw53b3j0ac1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9id2fsdgvyc19sz2xrx2nvbs9faddmbggweefmaejom1frdxk5ofrlb0jpn09poghoxzd0dfzfcw56wwr1yknbp3j0aw1lpvn3cwtevjhumkvn&amp\;cid=2ae6d679-a1b4-4b0f-a76a-46e32d437c42",nocase; classtype:attempted-recon; sid:200009920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wilsonvaluation602-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/brian_wilsonvaluation_com/evgzsh2f49natji6i_lnklcbz46ledpzwpckxs6jgi7zmw?e=un6z",nocase; classtype:attempted-recon; sid:200009921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winfreyandco-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/brandon_wincodc_com/esxchyyuht1diztxkz0fzm8boma-_ssknhdzjbh7xexnxa?e=vapt5b",nocase; classtype:attempted-recon; sid:200009922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withkoji.com",nocase; http_uri; content:"/@coxupdate78",nocase; classtype:attempted-recon; sid:200009923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wm88bet.com",nocase; http_uri; content:"/f6.php",nocase; classtype:attempted-recon; sid:200009924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvk12-my.sharepoint.com",nocase; http_uri; content:"/personal/pklewis_k12_wv_us/_layouts/15/wopiframe.aspx?guestaccesstoken=tqintdtuii%2bam%2fbqmtnjkenggs2dptoi8hs2jqftjkq%3d&docid=1_1446052cffa4c4871bd24bb98fe86ed6d&wdformid=%7bdf30d25d%2d0b59%2d47e5%2d956e%2dc601397ea4d7%7d&action=formsubmit&cid=57cdb8ab-426b-4eff-a51f-903ee3684f96",nocase; classtype:attempted-recon; sid:200009925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com",nocase; classtype:attempted-recon; sid:200009926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com2.",nocase; classtype:attempted-recon; sid:200009927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=organization",nocase; classtype:attempted-recon; sid:200009928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xurl.es",nocase; http_uri; content:"/l0f93",nocase; classtype:attempted-recon; sid:200009929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yarwoodfineart.com",nocase; http_uri; content:"/chpost/ch/",nocase; classtype:attempted-recon; sid:200009930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yastatic.net",nocase; http_uri; content:"/awaps-ad-sdk-js-bundles/1.0-3871/bundles-es2017/inpage.bundle.js",nocase; classtype:attempted-recon; sid:200009931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youengage.me",nocase; http_uri; content:"/p/61164367233af501000121a2",nocase; classtype:attempted-recon; sid:200009932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youtube.com",nocase; http_uri; content:"/redirect?event=video_description&amp\;redir_token=quffluhqazjnrtryamdoudhsmxhgbfzqvnm4ymrczlk5d3xbq3jtc0trauh6afm2v2zrzjzzwvdwlxqxwtvntvjkx19olvbmbkg2whdradbnmlzon2jxoudezdjium5hqtnpav9qsgtfufjizeltb0jgr1ddr0d0vk5qsurlmewtrvfnnmg2n28xswlcujzla2t4bfloewzsaw&amp\;q=https%3a%2f%2fbit.ly%2f2qq1myh",nocase; classtype:attempted-recon; sid:200009933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytthn.com",nocase; http_uri; content:"/click-dqkla3al-hfdqch9w?bt=25&amp\;tl=1&amp\;url=http://www.microsoft.com/&amp\;sa=k4cph5afjt010fz50ihbd",nocase; classtype:attempted-recon; sid:200009934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/0561j6",nocase; classtype:attempted-recon; sid:200009935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/2s45v2",nocase; classtype:attempted-recon; sid:200009936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/kms8u47zlxwk",nocase; classtype:attempted-recon; sid:200009937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/nckeqquhrpuf",nocase; classtype:attempted-recon; sid:200009938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#%0%",nocase; classtype:attempted-recon; sid:200009939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200009940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#clarencecalhoun@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200009941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#jaygallagher@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200009942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#omflavin@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200009943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rb7bg#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200009944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rfyal96cb4jj",nocase; classtype:attempted-recon; sid:200009945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/ruttb",nocase; classtype:attempted-recon; sid:200009946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/twq3f",nocase; classtype:attempted-recon; sid:200009947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zroei-pccnb.flounderfit.com",nocase; http_uri; content:"/#jaekyeum.kim@sc.com",nocase; classtype:attempted-recon; sid:200009948; rev:1;)
Reference in New Issue View Git Blame Copy Permalink