curben
/
phishing-filter
mirror of https://gitlab.com/malware-filter/phishing-filter
1
0
Fork 0
Code Issues Releases Wiki Activity
phishing-filter/dist/phishing-filter-snort3.rules

6565 lines
1.5 MiB
Raw Blame History

# Title: Phishing URL Snort3 Ruleset
# Updated: Mon, 20 Dec 2021 12:01:47 +0000
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/
# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"006.zzz.com.ua",nocase; classtype:attempted-recon; sid:200000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-billing-support.org",nocase; classtype:attempted-recon; sid:200000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-invalid-bundle.com",nocase; classtype:attempted-recon; sid:200000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"08863299.sso-secure-mail0454etr.pages.dev",nocase; classtype:attempted-recon; sid:200000004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0bs.de",nocase; classtype:attempted-recon; sid:200000005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0rg4n1z3r-c0mf1rmc3nt3r.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0tnr44.stat-pulse.com",nocase; classtype:attempted-recon; sid:200000007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"100000007894156146005611-ar.tk",nocase; classtype:attempted-recon; sid:200000008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"101.32.192.174",nocase; classtype:attempted-recon; sid:200000009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"102update1.creatorlink.net",nocase; classtype:attempted-recon; sid:200000010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"103.114.16.4",nocase; classtype:attempted-recon; sid:200000011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.244",nocase; classtype:attempted-recon; sid:200000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.248",nocase; classtype:attempted-recon; sid:200000013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"107.172.198.119",nocase; classtype:attempted-recon; sid:200000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"113.164.17.147",nocase; classtype:attempted-recon; sid:200000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"114805630378760.web.id",nocase; classtype:attempted-recon; sid:200000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"114806303578760.web.id",nocase; classtype:attempted-recon; sid:200000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"114836506724935.web.id",nocase; classtype:attempted-recon; sid:200000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"119.28.91.122",nocase; classtype:attempted-recon; sid:200000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"121techyard.com",nocase; classtype:attempted-recon; sid:200000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"124.156.136.189",nocase; classtype:attempted-recon; sid:200000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1249d4d7.6u56u665y6h45g45tg3.pages.dev",nocase; classtype:attempted-recon; sid:200000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"130.211.30.154",nocase; classtype:attempted-recon; sid:200000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"139.59.228.88",nocase; classtype:attempted-recon; sid:200000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"14.63.195.13",nocase; classtype:attempted-recon; sid:200000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"14.98.234.77",nocase; classtype:attempted-recon; sid:200000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1451170498503388.web.id",nocase; classtype:attempted-recon; sid:200000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.210.143.165",nocase; classtype:attempted-recon; sid:200000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"15004083383734.data-store-company.com",nocase; classtype:attempted-recon; sid:200000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"154.30.211.130.bc.googleusercontent.com",nocase; classtype:attempted-recon; sid:200000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"155.94.170.223",nocase; classtype:attempted-recon; sid:200000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.18",nocase; classtype:attempted-recon; sid:200000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.35",nocase; classtype:attempted-recon; sid:200000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"159.203.115.201",nocase; classtype:attempted-recon; sid:200000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"161.35.142.2",nocase; classtype:attempted-recon; sid:200000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"161.35.56.215",nocase; classtype:attempted-recon; sid:200000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"161.35.61.74",nocase; classtype:attempted-recon; sid:200000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"165.22.103.235",nocase; classtype:attempted-recon; sid:200000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"165.227.122.125",nocase; classtype:attempted-recon; sid:200000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"172.217.21.162",nocase; classtype:attempted-recon; sid:200000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"178-62-213-188.cprapid.com",nocase; classtype:attempted-recon; sid:200000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18-212-134-78.cprapid.com",nocase; classtype:attempted-recon; sid:200000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"180betper.blogspot.com",nocase; classtype:attempted-recon; sid:200000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.120.7.187",nocase; classtype:attempted-recon; sid:200000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18666-2460.s2.webspace.re",nocase; classtype:attempted-recon; sid:200000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188elexusbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"190854.8b.io",nocase; classtype:attempted-recon; sid:200000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"193.135.153.242",nocase; classtype:attempted-recon; sid:200000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"19636-2695.s2.webspace.re",nocase; classtype:attempted-recon; sid:200000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"198.52.100.42",nocase; classtype:attempted-recon; sid:200000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1dom.club",nocase; classtype:attempted-recon; sid:200000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1inich.exchange",nocase; classtype:attempted-recon; sid:200000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1m5yp.csb.app",nocase; classtype:attempted-recon; sid:200000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1mf0rm4t10n-v3ryfyl1t3d.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1millionnfts.art",nocase; classtype:attempted-recon; sid:200000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1ncih.exchange",nocase; classtype:attempted-recon; sid:200000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1rtzr7v.cn",nocase; classtype:attempted-recon; sid:200000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1und1center.tumblr.com",nocase; classtype:attempted-recon; sid:200000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2.136.95.251",nocase; classtype:attempted-recon; sid:200000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20.124.177.246",nocase; classtype:attempted-recon; sid:200000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20.206.88.15",nocase; classtype:attempted-recon; sid:200000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20140301.xyz",nocase; classtype:attempted-recon; sid:200000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"208.82.115.230",nocase; classtype:attempted-recon; sid:200000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"209.97.188.25",nocase; classtype:attempted-recon; sid:200000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"211.57.201.45",nocase; classtype:attempted-recon; sid:200000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"212897764576871473832-dot-bn058.csb.app",nocase; classtype:attempted-recon; sid:200000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"217651.8b.io",nocase; classtype:attempted-recon; sid:200000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"222.231.3.128",nocase; classtype:attempted-recon; sid:200000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"234.boyid88784.workers.dev",nocase; classtype:attempted-recon; sid:200000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"23447932.com",nocase; classtype:attempted-recon; sid:200000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"245.riliwob272.workers.dev",nocase; classtype:attempted-recon; sid:200000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"24611250.sibforms.com",nocase; classtype:attempted-recon; sid:200000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2482689012.yolasite.com",nocase; classtype:attempted-recon; sid:200000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2524santan-d-er0.hostfree.pw",nocase; classtype:attempted-recon; sid:200000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"25tnr.app.link",nocase; classtype:attempted-recon; sid:200000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"260644752133801818.weebly.com",nocase; classtype:attempted-recon; sid:200000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"26653577.com",nocase; classtype:attempted-recon; sid:200000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"299kensingtonroad.my.webex.com",nocase; classtype:attempted-recon; sid:200000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2fa.bthei.com",nocase; classtype:attempted-recon; sid:200000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2ffth.csb.app",nocase; classtype:attempted-recon; sid:200000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2pil.ru",nocase; classtype:attempted-recon; sid:200000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2qibxad421.site44.com",nocase; classtype:attempted-recon; sid:200000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2yoxtja1gg.cuasaighmsgjtrebolar.com",nocase; classtype:attempted-recon; sid:200000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"300pujcka.cz",nocase; classtype:attempted-recon; sid:200000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"30ywc.codesandbox.io",nocase; classtype:attempted-recon; sid:200000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31.13.71.1",nocase; classtype:attempted-recon; sid:200000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"343i.org",nocase; classtype:attempted-recon; sid:200000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.186.228.86",nocase; classtype:attempted-recon; sid:200000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.192.38.184",nocase; classtype:attempted-recon; sid:200000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.199.84.117",nocase; classtype:attempted-recon; sid:200000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"365online-resolve.com",nocase; classtype:attempted-recon; sid:200000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev",nocase; classtype:attempted-recon; sid:200000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ck.me",nocase; classtype:attempted-recon; sid:200000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3dprintersupplies.com.au",nocase; classtype:attempted-recon; sid:200000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3e.ralmakesta.workers.dev",nocase; classtype:attempted-recon; sid:200000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3f28lbb.cn",nocase; classtype:attempted-recon; sid:200000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3j124.csb.app",nocase; classtype:attempted-recon; sid:200000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3name.com",nocase; classtype:attempted-recon; sid:200000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3no.ro",nocase; classtype:attempted-recon; sid:200000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42.193.110.254",nocase; classtype:attempted-recon; sid:200000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42e381ec-b86b-49f1-a24d-75834d1779f4.id.repl.co",nocase; classtype:attempted-recon; sid:200000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42telecom.com.br",nocase; classtype:attempted-recon; sid:200000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"439844890710-help.gq",nocase; classtype:attempted-recon; sid:200000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"43984489079-help.gq",nocase; classtype:attempted-recon; sid:200000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.186.132.130",nocase; classtype:attempted-recon; sid:200000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.40.130.40",nocase; classtype:attempted-recon; sid:200000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.9.20.146",nocase; classtype:attempted-recon; sid:200000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45help43.creatorlink.net",nocase; classtype:attempted-recon; sid:200000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.101.162.235",nocase; classtype:attempted-recon; sid:200000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.252.7.30",nocase; classtype:attempted-recon; sid:200000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.99.172.49",nocase; classtype:attempted-recon; sid:200000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"48943984076-help.gq",nocase; classtype:attempted-recon; sid:200000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"48tlp.codesandbox.io",nocase; classtype:attempted-recon; sid:200000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4a14def9.sibforms.com",nocase; classtype:attempted-recon; sid:200000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4lxkd.r.ag.d.sendibm3.com",nocase; classtype:attempted-recon; sid:200000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4zwkx.codesandbox.io",nocase; classtype:attempted-recon; sid:200000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.222.193.61",nocase; classtype:attempted-recon; sid:200000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.fi",nocase; classtype:attempted-recon; sid:200000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"52.148.252.166",nocase; classtype:attempted-recon; sid:200000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5372365.com",nocase; classtype:attempted-recon; sid:200000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"53vzxcnk6rwp.clickfunnels.com",nocase; classtype:attempted-recon; sid:200000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"541512.xyz",nocase; classtype:attempted-recon; sid:200000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"541514.xyz",nocase; classtype:attempted-recon; sid:200000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54sadwd.j3byerqkbs.workers.dev",nocase; classtype:attempted-recon; sid:200000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55454615466641.hyperphp.com",nocase; classtype:attempted-recon; sid:200000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55bgf.csb.app",nocase; classtype:attempted-recon; sid:200000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567656474653364.hyperphp.com",nocase; classtype:attempted-recon; sid:200000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5e841ae2.srvr-cloudmail-srvr6765e7tg.pages.dev",nocase; classtype:attempted-recon; sid:200000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5gg7y.csb.app",nocase; classtype:attempted-recon; sid:200000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"60000000000684987321695498726.tk",nocase; classtype:attempted-recon; sid:200000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"613707.selcdn.ru",nocase; classtype:attempted-recon; sid:200000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"61da8ae6.6u6566hrrthsh45.pages.dev",nocase; classtype:attempted-recon; sid:200000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6321522.com",nocase; classtype:attempted-recon; sid:200000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"637900.selcdn.ru",nocase; classtype:attempted-recon; sid:200000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"643509.selcdn.ru",nocase; classtype:attempted-recon; sid:200000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"650vm.app.link",nocase; classtype:attempted-recon; sid:200000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.42.59.83",nocase; classtype:attempted-recon; sid:200000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6600035.com",nocase; classtype:attempted-recon; sid:200000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"67lksxgjd.bttmassage-thai-tanger.com",nocase; classtype:attempted-recon; sid:200000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"68.178.252.133",nocase; classtype:attempted-recon; sid:200000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6c7f0acc.sibforms.com",nocase; classtype:attempted-recon; sid:200000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6e33r.codesandbox.io",nocase; classtype:attempted-recon; sid:200000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6vvvvvw-metam.top",nocase; classtype:attempted-recon; sid:200000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"725865102777075249.eu-gb.cf.appdomain.cloud",nocase; classtype:attempted-recon; sid:200000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7367365.com",nocase; classtype:attempted-recon; sid:200000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7485-veri365.servehalflife.com",nocase; classtype:attempted-recon; sid:200000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"78.108.89.240",nocase; classtype:attempted-recon; sid:200000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7a4298b9.sso-mail-secure234ds23d23wd1.pages.dev",nocase; classtype:attempted-recon; sid:200000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7bancalnterbank.com",nocase; classtype:attempted-recon; sid:200000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7clouds.vrdp.online",nocase; classtype:attempted-recon; sid:200000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7d54v.app.link",nocase; classtype:attempted-recon; sid:200000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7ku50.csb.app",nocase; classtype:attempted-recon; sid:200000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7vvvwv-metamas.top",nocase; classtype:attempted-recon; sid:200000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7wr4u.csb.app",nocase; classtype:attempted-recon; sid:200000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7yu3v.csb.app",nocase; classtype:attempted-recon; sid:200000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8.208.15.125",nocase; classtype:attempted-recon; sid:200000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"800emailsupport.com",nocase; classtype:attempted-recon; sid:200000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.be",nocase; classtype:attempted-recon; sid:200000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"81cbfgwh53.extentwulfsaqqehqdwicczanin.com",nocase; classtype:attempted-recon; sid:200000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8765423564342.hyperphp.com",nocase; classtype:attempted-recon; sid:200000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8dw5g.codesandbox.io",nocase; classtype:attempted-recon; sid:200000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"92gkq6s.cn",nocase; classtype:attempted-recon; sid:200000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"98760.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"98yiujh.9peop5jzad1945.workers.dev",nocase; classtype:attempted-recon; sid:200000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99.jarzevokke.workers.dev",nocase; classtype:attempted-recon; sid:200000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9xnog.csb.app",nocase; classtype:attempted-recon; sid:200000173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.acesstnn.com",nocase; classtype:attempted-recon; sid:200000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200000175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.aensmaoesmi.com",nocase; classtype:attempted-recon; sid:200000176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.aoeaomsnexc.com",nocase; classtype:attempted-recon; sid:200000177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200000178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.casscard.com",nocase; classtype:attempted-recon; sid:200000179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.coesacd.com",nocase; classtype:attempted-recon; sid:200000180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.csecoed.com",nocase; classtype:attempted-recon; sid:200000181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.maceisnmi.com",nocase; classtype:attempted-recon; sid:200000182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.mcsemrini.com",nocase; classtype:attempted-recon; sid:200000183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a.measeriiei.com",nocase; classtype:attempted-recon; sid:200000184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a0570626.xsph.ru",nocase; classtype:attempted-recon; sid:200000185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a0608809.xsph.ru",nocase; classtype:attempted-recon; sid:200000186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a2odev.com",nocase; classtype:attempted-recon; sid:200000187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a4d3b42c.chgmar-d8y.pages.dev",nocase; classtype:attempted-recon; sid:200000188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a71843c1.mailssocloud-srvr65e5rd.pages.dev",nocase; classtype:attempted-recon; sid:200000189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a987543.servehalflife.com",nocase; classtype:attempted-recon; sid:200000190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aagamsteelcorporation.com",nocase; classtype:attempted-recon; sid:200000191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aave.bz",nocase; classtype:attempted-recon; sid:200000192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aave.cool",nocase; classtype:attempted-recon; sid:200000193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aback-lace-mambo.glitch.me",nocase; classtype:attempted-recon; sid:200000194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abagency.rw",nocase; classtype:attempted-recon; sid:200000195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abamazproduct.net",nocase; classtype:attempted-recon; sid:200000196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolute-containers-sip.business.site",nocase; classtype:attempted-recon; sid:200000197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolutepleasure.com.my",nocase; classtype:attempted-recon; sid:200000198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abszolutauto.hu",nocase; classtype:attempted-recon; sid:200000199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acacia.webdevonline.net",nocase; classtype:attempted-recon; sid:200000200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accelshare.com",nocase; classtype:attempted-recon; sid:200000201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"access-amzn.judw.cn",nocase; classtype:attempted-recon; sid:200000202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accesso-clienti.attiva-servizi-2021.com",nocase; classtype:attempted-recon; sid:200000203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account-id071.com",nocase; classtype:attempted-recon; sid:200000204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account-live-seciurty-protect-tcj23.ondigitalocean.app",nocase; classtype:attempted-recon; sid:200000205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.americaevnxpress.com",nocase; classtype:attempted-recon; sid:200000206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.herephyshy.info",nocase; classtype:attempted-recon; sid:200000207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.verifications.help-page.workers.dev",nocase; classtype:attempted-recon; sid:200000208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountsmantras.com",nocase; classtype:attempted-recon; sid:200000209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accts-validtion55akda.cf",nocase; classtype:attempted-recon; sid:200000210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessobradesco.digital",nocase; classtype:attempted-recon; sid:200000211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"achilles-group.com",nocase; classtype:attempted-recon; sid:200000212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acpvirtual.com",nocase; classtype:attempted-recon; sid:200000213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acrepairaplus.com",nocase; classtype:attempted-recon; sid:200000214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activartransferenciainternacional.com",nocase; classtype:attempted-recon; sid:200000215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activate-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200000216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activatingmainnet.com",nocase; classtype:attempted-recon; sid:200000217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actkid.com",nocase; classtype:attempted-recon; sid:200000218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actplan.eu",nocase; classtype:attempted-recon; sid:200000219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adamfeber.com",nocase; classtype:attempted-recon; sid:200000220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adcloudserver.com",nocase; classtype:attempted-recon; sid:200000221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"addictionrecoveryservices.com",nocase; classtype:attempted-recon; sid:200000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adeshgroup.in",nocase; classtype:attempted-recon; sid:200000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adityaschooljabalpur.com",nocase; classtype:attempted-recon; sid:200000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adjuntarcitacr.com",nocase; classtype:attempted-recon; sid:200000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin-formserviceupdates.weeblysite.com",nocase; classtype:attempted-recon; sid:200000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.dreamploy.com",nocase; classtype:attempted-recon; sid:200000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.sitesumo.com",nocase; classtype:attempted-recon; sid:200000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin1.64-b.it",nocase; classtype:attempted-recon; sid:200000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admins-aeon.serveftp.com",nocase; classtype:attempted-recon; sid:200000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adpunemploymentclaims.sharefile.com",nocase; classtype:attempted-recon; sid:200000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adsmarca.com",nocase; classtype:attempted-recon; sid:200000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aemnzacx.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aemzscv.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeom.lesuoju.com",nocase; classtype:attempted-recon; sid:200000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeom.miqizi.com",nocase; classtype:attempted-recon; sid:200000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeom.sifangw.com",nocase; classtype:attempted-recon; sid:200000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aerflofans.com",nocase; classtype:attempted-recon; sid:200000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aflaci.com",nocase; classtype:attempted-recon; sid:200000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afreemart.xyz",nocase; classtype:attempted-recon; sid:200000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"africansecrets.ca",nocase; classtype:attempted-recon; sid:200000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"againforcreating.hostingamazoncardin.buzz",nocase; classtype:attempted-recon; sid:200000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"againforcreating.underamazonone.buzz",nocase; classtype:attempted-recon; sid:200000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agora.imb.br",nocase; classtype:attempted-recon; sid:200000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricagroup.net",nocase; classtype:attempted-recon; sid:200000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agrimetiersmartinique.fr",nocase; classtype:attempted-recon; sid:200000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agurimu-nagoya.com",nocase; classtype:attempted-recon; sid:200000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aid-validation-human.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aimekidya-recpag.web.id",nocase; classtype:attempted-recon; sid:200000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"airportprescreening.com",nocase; classtype:attempted-recon; sid:200000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ajdvcnafaturamallu.com",nocase; classtype:attempted-recon; sid:200000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akanksha3012.github.io",nocase; classtype:attempted-recon; sid:200000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akbidbungakalimantan.ac.id",nocase; classtype:attempted-recon; sid:200000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akhandayurclinic.com",nocase; classtype:attempted-recon; sid:200000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akmastiyan.ga",nocase; classtype:attempted-recon; sid:200000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akreditasi.pspd.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aks34.github.io",nocase; classtype:attempted-recon; sid:200000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aksehirelittotel.com",nocase; classtype:attempted-recon; sid:200000258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aksjoeomraadet.no",nocase; classtype:attempted-recon; sid:200000259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualisierung-gmx.yolasite.com",nocase; classtype:attempted-recon; sid:200000260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualisierunggmx.yolasite.com",nocase; classtype:attempted-recon; sid:200000261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualizacja.jst.pl",nocase; classtype:attempted-recon; sid:200000262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"al-amaleka.com",nocase; classtype:attempted-recon; sid:200000263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alareentading-catalog.page.tl",nocase; classtype:attempted-recon; sid:200000264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"albel.intnet.mu",nocase; classtype:attempted-recon; sid:200000265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aldana.in",nocase; classtype:attempted-recon; sid:200000266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alertastone-security.me",nocase; classtype:attempted-recon; sid:200000267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerts.department.improvement.workers.dev",nocase; classtype:attempted-recon; sid:200000268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alexxou.website2.me",nocase; classtype:attempted-recon; sid:200000269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfaauv.com",nocase; classtype:attempted-recon; sid:200000270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfacomputers.be",nocase; classtype:attempted-recon; sid:200000271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfasupport.ru",nocase; classtype:attempted-recon; sid:200000272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alg1.25sotok.ru",nocase; classtype:attempted-recon; sid:200000273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"algotextil.com.br",nocase; classtype:attempted-recon; sid:200000274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alhhumzim90.com.ng",nocase; classtype:attempted-recon; sid:200000275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alhilalsudan.net",nocase; classtype:attempted-recon; sid:200000276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alibabatrading.jo",nocase; classtype:attempted-recon; sid:200000277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alicesecurity.ro",nocase; classtype:attempted-recon; sid:200000278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliciabot.azurewebsites.net",nocase; classtype:attempted-recon; sid:200000279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkawaterdiy.com",nocase; classtype:attempted-recon; sid:200000280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkhalilgraphics.com",nocase; classtype:attempted-recon; sid:200000281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allcaredentalcentre.in",nocase; classtype:attempted-recon; sid:200000282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro.qumucloud.com",nocase; classtype:attempted-recon; sid:200000283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsafe.dostawa-id.live",nocase; classtype:attempted-recon; sid:200000284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsafe.dostawa-ids.xyz",nocase; classtype:attempted-recon; sid:200000285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsec.dostawa-ids.xyz",nocase; classtype:attempted-recon; sid:200000286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-3dsecure.dostawa-id.live",nocase; classtype:attempted-recon; sid:200000287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl-safe.clear-id.xyz",nocase; classtype:attempted-recon; sid:200000288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.35789.space",nocase; classtype:attempted-recon; sid:200000289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.648534.space",nocase; classtype:attempted-recon; sid:200000290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.clear-id.xyz",nocase; classtype:attempted-recon; sid:200000291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.dostawa-id.live",nocase; classtype:attempted-recon; sid:200000292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.id73743.space",nocase; classtype:attempted-recon; sid:200000293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allianzbankmypostweb.datlas.it",nocase; classtype:attempted-recon; sid:200000294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allovisite.com",nocase; classtype:attempted-recon; sid:200000295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allstardeluxecarwash.com",nocase; classtype:attempted-recon; sid:200000296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"almighty.edu.np",nocase; classtype:attempted-recon; sid:200000297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aloun.ps",nocase; classtype:attempted-recon; sid:200000298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alqadi.ps",nocase; classtype:attempted-recon; sid:200000299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alqasba.futuristic.agency",nocase; classtype:attempted-recon; sid:200000300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alquilervillora.net",nocase; classtype:attempted-recon; sid:200000301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alservic-tirmiles.blogspot.com",nocase; classtype:attempted-recon; sid:200000302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alsofft.com",nocase; classtype:attempted-recon; sid:200000303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumdecor.ru",nocase; classtype:attempted-recon; sid:200000304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumnimkn.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alwazzanfactory.com",nocase; classtype:attempted-recon; sid:200000306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.10co1.co",nocase; classtype:attempted-recon; sid:200000307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.5co1.co",nocase; classtype:attempted-recon; sid:200000308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.at6i.info",nocase; classtype:attempted-recon; sid:200000309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.at7i.info",nocase; classtype:attempted-recon; sid:200000310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.at9i.info",nocase; classtype:attempted-recon; sid:200000311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.fr2e.co",nocase; classtype:attempted-recon; sid:200000312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.fr3e.info",nocase; classtype:attempted-recon; sid:200000313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ama-check.fr4e.co",nocase; classtype:attempted-recon; sid:200000314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaazzo.co.ip.n6f.top",nocase; classtype:attempted-recon; sid:200000315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaderphone.com",nocase; classtype:attempted-recon; sid:200000316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaeoncnjp.jzyxx.com",nocase; classtype:attempted-recon; sid:200000317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-account-update.snues.ga",nocase; classtype:attempted-recon; sid:200000318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanuts.com",nocase; classtype:attempted-recon; sid:200000319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaoez.jidu3iio.xyz",nocase; classtype:attempted-recon; sid:200000320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaongeiuyhhelggewgiohsruwr.xyz",nocase; classtype:attempted-recon; sid:200000321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.akkkj.com",nocase; classtype:attempted-recon; sid:200000322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.ayayx.com",nocase; classtype:attempted-recon; sid:200000323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.mtnmole.com",nocase; classtype:attempted-recon; sid:200000324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.neklu.com",nocase; classtype:attempted-recon; sid:200000325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.onvirb.com",nocase; classtype:attempted-recon; sid:200000326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozn.ywcimei.com",nocase; classtype:attempted-recon; sid:200000327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.2yk4m8.cn",nocase; classtype:attempted-recon; sid:200000328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.caipiao44.cn",nocase; classtype:attempted-recon; sid:200000329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxie0ryp6.cn",nocase; classtype:attempted-recon; sid:200000330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxie3ycfe.cn",nocase; classtype:attempted-recon; sid:200000331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxie9csgd.cn",nocase; classtype:attempted-recon; sid:200000332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxiefl5j9.cn",nocase; classtype:attempted-recon; sid:200000333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxieqv1a2.cn",nocase; classtype:attempted-recon; sid:200000334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxiewxy1c.cn",nocase; classtype:attempted-recon; sid:200000335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.ptxieznakw.cn",nocase; classtype:attempted-recon; sid:200000336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.co.jp.srlcs.cn",nocase; classtype:attempted-recon; sid:200000337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.nrxcgjlawv.cn",nocase; classtype:attempted-recon; sid:200000338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.sdppzk.cn",nocase; classtype:attempted-recon; sid:200000339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.sxkzd.cn",nocase; classtype:attempted-recon; sid:200000340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaozom.tjpmgkhxwc.cn",nocase; classtype:attempted-recon; sid:200000341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amarjumat1.co.vu",nocase; classtype:attempted-recon; sid:200000342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaxcarrentals.com.au",nocase; classtype:attempted-recon; sid:200000343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amayzo.com",nocase; classtype:attempted-recon; sid:200000344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaz-check-info2.pk-11.top",nocase; classtype:attempted-recon; sid:200000345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaz-check-info3.er-5.top",nocase; classtype:attempted-recon; sid:200000346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaz-check.1sopo.buzz",nocase; classtype:attempted-recon; sid:200000347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaz.eiwczmv.cn",nocase; classtype:attempted-recon; sid:200000348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazen.idfj4tyi.top",nocase; classtype:attempted-recon; sid:200000349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazing-gould.159-203-7-218.plesk.page",nocase; classtype:attempted-recon; sid:200000350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznli.co.jp.ateyou.net",nocase; classtype:attempted-recon; sid:200000351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznli.co.jp.axiong.net",nocase; classtype:attempted-recon; sid:200000352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznli.co.jp.laledu.net",nocase; classtype:attempted-recon; sid:200000353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznlio.co.jp.lrw.net.cn",nocase; classtype:attempted-recon; sid:200000354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznlo.ip.jp.hwpp.net",nocase; classtype:attempted-recon; sid:200000355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznlo.ip.jp.youyina.net",nocase; classtype:attempted-recon; sid:200000356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.cbnodmv.xyz",nocase; classtype:attempted-recon; sid:200000357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.login.flzimdrtnx.cn",nocase; classtype:attempted-recon; sid:200000358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.sdkldzd.xyz",nocase; classtype:attempted-recon; sid:200000359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ji1n.co",nocase; classtype:attempted-recon; sid:200000360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ji1r.co",nocase; classtype:attempted-recon; sid:200000361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ji1s.co",nocase; classtype:attempted-recon; sid:200000362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ji2r.co",nocase; classtype:attempted-recon; sid:200000363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.jo1t.co",nocase; classtype:attempted-recon; sid:200000364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.jo4t.co",nocase; classtype:attempted-recon; sid:200000365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.ttuo2.co",nocase; classtype:attempted-recon; sid:200000366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-gcatech.com",nocase; classtype:attempted-recon; sid:200000367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-interruption.com",nocase; classtype:attempted-recon; sid:200000368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-s.club",nocase; classtype:attempted-recon; sid:200000369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.adunma.club",nocase; classtype:attempted-recon; sid:200000370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.chisteles.com",nocase; classtype:attempted-recon; sid:200000371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.27deantterwow.club",nocase; classtype:attempted-recon; sid:200000372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.abaiaccounting.cn",nocase; classtype:attempted-recon; sid:200000373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.abaibaseball.cn",nocase; classtype:attempted-recon; sid:200000374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.ddsozh.cn",nocase; classtype:attempted-recon; sid:200000375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.eqwkko.cn",nocase; classtype:attempted-recon; sid:200000376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.icwrhee.cn",nocase; classtype:attempted-recon; sid:200000377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.nkntjq.cn",nocase; classtype:attempted-recon; sid:200000378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.sfzf.life",nocase; classtype:attempted-recon; sid:200000379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.souxxu.cn",nocase; classtype:attempted-recon; sid:200000380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.tebiqn.cn",nocase; classtype:attempted-recon; sid:200000381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.uevjez.cn",nocase; classtype:attempted-recon; sid:200000382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.v1s.top",nocase; classtype:attempted-recon; sid:200000383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.vacty.ltd",nocase; classtype:attempted-recon; sid:200000384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.wwngfoa.cn",nocase; classtype:attempted-recon; sid:200000385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.wwsgioe.cn",nocase; classtype:attempted-recon; sid:200000386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.x6i.top",nocase; classtype:attempted-recon; sid:200000387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.xicjxxd.cn",nocase; classtype:attempted-recon; sid:200000388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.y9i.top",nocase; classtype:attempted-recon; sid:200000389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.yh9zt.cn",nocase; classtype:attempted-recon; sid:200000390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.ywhmnj.cn",nocase; classtype:attempted-recon; sid:200000391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.jp.zwjzrsa.cn",nocase; classtype:attempted-recon; sid:200000392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.jp.ruifu.club",nocase; classtype:attempted-recon; sid:200000393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.k-komaki.com",nocase; classtype:attempted-recon; sid:200000394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.magnetsu.com",nocase; classtype:attempted-recon; sid:200000395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.qtreva.club",nocase; classtype:attempted-recon; sid:200000396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.qwesa.club",nocase; classtype:attempted-recon; sid:200000397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.rcvbfo.club",nocase; classtype:attempted-recon; sid:200000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.works.ga",nocase; classtype:attempted-recon; sid:200000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.xideban.cn",nocase; classtype:attempted-recon; sid:200000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoncojp.29deantterwow.club",nocase; classtype:attempted-recon; sid:200000401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoneo.ypfouay.cn",nocase; classtype:attempted-recon; sid:200000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonfweysdgfh.xyz",nocase; classtype:attempted-recon; sid:200000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonlogistics-ap-northeast-1.amazonlogistics.jp",nocase; classtype:attempted-recon; sid:200000404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonsssa.buzz",nocase; classtype:attempted-recon; sid:200000405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoon.co.op.o4j.top",nocase; classtype:attempted-recon; sid:200000406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazunlogin.shop",nocase; classtype:attempted-recon; sid:200000407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambienteprotegido.foregon.com",nocase; classtype:attempted-recon; sid:200000408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambil-evendt.duckdns.org",nocase; classtype:attempted-recon; sid:200000409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amc-training.com",nocase; classtype:attempted-recon; sid:200000410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amcgardiennage.com",nocase; classtype:attempted-recon; sid:200000411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amco.jp.qg0e3g.cn",nocase; classtype:attempted-recon; sid:200000412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.1tz.com.cn",nocase; classtype:attempted-recon; sid:200000413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.58du.com.cn",nocase; classtype:attempted-recon; sid:200000414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.5y5y.com.cn",nocase; classtype:attempted-recon; sid:200000415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.6jk.com.cn",nocase; classtype:attempted-recon; sid:200000416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.alww.com.cn",nocase; classtype:attempted-recon; sid:200000417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.cmzg.com.cn",nocase; classtype:attempted-recon; sid:200000418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.conghu.com.cn",nocase; classtype:attempted-recon; sid:200000419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.dmzz.com.cn",nocase; classtype:attempted-recon; sid:200000420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.laopan.com.cn",nocase; classtype:attempted-recon; sid:200000421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.lppf.com.cn",nocase; classtype:attempted-recon; sid:200000422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.nadong.com.cn",nocase; classtype:attempted-recon; sid:200000423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.nalin.com.cn",nocase; classtype:attempted-recon; sid:200000424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.penkuan.com.cn",nocase; classtype:attempted-recon; sid:200000425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.xiis.com.cn",nocase; classtype:attempted-recon; sid:200000426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.co.jp.yllx.com.cn",nocase; classtype:attempted-recon; sid:200000427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.iibr.com.cn",nocase; classtype:attempted-recon; sid:200000428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.netclubtb.com",nocase; classtype:attempted-recon; sid:200000429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.newgraud.com",nocase; classtype:attempted-recon; sid:200000430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.newlandtc.com",nocase; classtype:attempted-recon; sid:200000431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.nokiae74.com",nocase; classtype:attempted-recon; sid:200000432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.norbeweb.com",nocase; classtype:attempted-recon; sid:200000433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.nutrofina.com",nocase; classtype:attempted-recon; sid:200000434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.oaiautos.com",nocase; classtype:attempted-recon; sid:200000435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.octihost.com",nocase; classtype:attempted-recon; sid:200000436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.onaworks.com",nocase; classtype:attempted-recon; sid:200000437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.oohjersey.com",nocase; classtype:attempted-recon; sid:200000438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.oramacom.com",nocase; classtype:attempted-recon; sid:200000439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.jp.orosinara.com",nocase; classtype:attempted-recon; sid:200000440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameozom.wvcmh15e.cn",nocase; classtype:attempted-recon; sid:200000441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americanoexpres.com",nocase; classtype:attempted-recon; sid:200000442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americarvxpress.com",nocase; classtype:attempted-recon; sid:200000443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amexzsa.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amguevara.com",nocase; classtype:attempted-recon; sid:200000445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amhgewrhjeoirueaswrtiukoy.xyz",nocase; classtype:attempted-recon; sid:200000446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amidabuli.com",nocase; classtype:attempted-recon; sid:200000447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amlnov7.web.app",nocase; classtype:attempted-recon; sid:200000448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amoazan.cqxjlp.com",nocase; classtype:attempted-recon; sid:200000449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amosleh.com",nocase; classtype:attempted-recon; sid:200000450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams-eg.com",nocase; classtype:attempted-recon; sid:200000451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzodnjp.shop",nocase; classtype:attempted-recon; sid:200000452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzona.co.jp.amozno.top",nocase; classtype:attempted-recon; sid:200000453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzoncojp.shop",nocase; classtype:attempted-recon; sid:200000454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anandsr-dev.github.io",nocase; classtype:attempted-recon; sid:200000455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anarchitecturestudio.com",nocase; classtype:attempted-recon; sid:200000456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anazno.co.ip.6.cn",nocase; classtype:attempted-recon; sid:200000457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anazomaccount.jlxmcw.cn",nocase; classtype:attempted-recon; sid:200000458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anbn.ru",nocase; classtype:attempted-recon; sid:200000459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ancient-field-a9f7.rbox49o.workers.dev",nocase; classtype:attempted-recon; sid:200000460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ancient-lab-15b5.rhn21600.workers.dev",nocase; classtype:attempted-recon; sid:200000461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andersonstrategic.com.au",nocase; classtype:attempted-recon; sid:200000462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andr.mulianct.us",nocase; classtype:attempted-recon; sid:200000463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andre-leone.format.com",nocase; classtype:attempted-recon; sid:200000464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-27.web.id",nocase; classtype:attempted-recon; sid:200000465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andromeda-manageer-association-78.web.id",nocase; classtype:attempted-recon; sid:200000466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"angiofsi.page.link",nocase; classtype:attempted-recon; sid:200000467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"angry-feynman-1ff0fb.netlify.app",nocase; classtype:attempted-recon; sid:200000468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aniotnbi.cc",nocase; classtype:attempted-recon; sid:200000469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anj-azakp.run.goorm.io",nocase; classtype:attempted-recon; sid:200000470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anjalijha167.github.io",nocase; classtype:attempted-recon; sid:200000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anmzon.2hbjfy0.cn",nocase; classtype:attempted-recon; sid:200000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annaeva.hu",nocase; classtype:attempted-recon; sid:200000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annamdecor.vn",nocase; classtype:attempted-recon; sid:200000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annazcn.annzen.xyz",nocase; classtype:attempted-recon; sid:200000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annuitiesusaa.com",nocase; classtype:attempted-recon; sid:200000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anoaer.knzprm.cn",nocase; classtype:attempted-recon; sid:200000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anon-keep-admin-keep.rvsla.workers.dev",nocase; classtype:attempted-recon; sid:200000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anonzon.u51n5l.cn",nocase; classtype:attempted-recon; sid:200000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antaresns.com",nocase; classtype:attempted-recon; sid:200000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antiguatabernaqueirolo.com",nocase; classtype:attempted-recon; sid:200000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ao.co.jp.aeps18p.cn",nocase; classtype:attempted-recon; sid:200000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ao.co.jp.xjoaep.cn",nocase; classtype:attempted-recon; sid:200000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ao0lmail03782.weebly.com",nocase; classtype:attempted-recon; sid:200000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aolmailukhelplinecustomerservice.blogspot.com",nocase; classtype:attempted-recon; sid:200000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aolmailukhelplinecustomerservice.blogspot.com.au",nocase; classtype:attempted-recon; sid:200000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aolxperience.com",nocase; classtype:attempted-recon; sid:200000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aomc.jp.cz0fpzx.cn",nocase; classtype:attempted-recon; sid:200000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ap.offlinks.xyz",nocase; classtype:attempted-recon; sid:200000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apeswapa.finance",nocase; classtype:attempted-recon; sid:200000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apeswvap.finance",nocase; classtype:attempted-recon; sid:200000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.saisoncard.co.jp.sctcwtech.com",nocase; classtype:attempted-recon; sid:200000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apikesbandung.ac.id",nocase; classtype:attempted-recon; sid:200000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aplus.co.jp.wkjrw.com",nocase; classtype:attempted-recon; sid:200000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aplus.nvclive.com",nocase; classtype:attempted-recon; sid:200000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apoioparaempresas.com",nocase; classtype:attempted-recon; sid:200000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-db-web-client.com",nocase; classtype:attempted-recon; sid:200000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-it.club",nocase; classtype:attempted-recon; sid:200000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.bydn217.club",nocase; classtype:attempted-recon; sid:200000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.duel.network",nocase; classtype:attempted-recon; sid:200000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.fiiber.ca",nocase; classtype:attempted-recon; sid:200000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.fxhalifax.com",nocase; classtype:attempted-recon; sid:200000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.mobile-recovery-pages09813639021174648273.jbud4ix21f-zqy3jw70y6kg.p.runcloud.link",nocase; classtype:attempted-recon; sid:200000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.moneylinecreditcorporation.com",nocase; classtype:attempted-recon; sid:200000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.n26.com.verificatoinformazioni.com",nocase; classtype:attempted-recon; sid:200000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pakikieshwap.com",nocase; classtype:attempted-recon; sid:200000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankeikswiap.com",nocase; classtype:attempted-recon; sid:200000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankeikswiaps.com",nocase; classtype:attempted-recon; sid:200000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pankieiswapis.com",nocase; classtype:attempted-recon; sid:200000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pipefy.com",nocase; classtype:attempted-recon; sid:200000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.sugarsync.com",nocase; classtype:attempted-recon; sid:200000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.surveymethods.com",nocase; classtype:attempted-recon; sid:200000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appatualizecef.com",nocase; classtype:attempted-recon; sid:200000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appcaixa.reativeseuapelido.support",nocase; classtype:attempted-recon; sid:200000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appcefseguros.me",nocase; classtype:attempted-recon; sid:200000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appearance.servebeer.com",nocase; classtype:attempted-recon; sid:200000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apple234yart.ru",nocase; classtype:attempted-recon; sid:200000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appleicloud.fr",nocase; classtype:attempted-recon; sid:200000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appleid-check.info",nocase; classtype:attempted-recon; sid:200000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apply.aua.am",nocase; classtype:attempted-recon; sid:200000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appssn26.com",nocase; classtype:attempted-recon; sid:200000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aptransways.net",nocase; classtype:attempted-recon; sid:200000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apzcocxp.co.vu",nocase; classtype:attempted-recon; sid:200000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aquarium-cleaning.ru",nocase; classtype:attempted-recon; sid:200000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arabsong.net",nocase; classtype:attempted-recon; sid:200000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arafathrumman.github.io",nocase; classtype:attempted-recon; sid:200000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arcanepubg.xyz",nocase; classtype:attempted-recon; sid:200000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archivio-supporto.sitoper.it",nocase; classtype:attempted-recon; sid:200000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arckrwxacqmnirpahmxgtvvczfiykq.22web.org",nocase; classtype:attempted-recon; sid:200000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areemnza.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.gtpzcve.cn",nocase; classtype:attempted-recon; sid:200000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.gtva.cn",nocase; classtype:attempted-recon; sid:200000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"argus-garage-doors-repair.com",nocase; classtype:attempted-recon; sid:200000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arif.com.bd",nocase; classtype:attempted-recon; sid:200000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arigatogifts.com",nocase; classtype:attempted-recon; sid:200000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arlehostz.com",nocase; classtype:attempted-recon; sid:200000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnaozn.mabstv.com",nocase; classtype:attempted-recon; sid:200000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnaozn.masmzj.com",nocase; classtype:attempted-recon; sid:200000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aromatic.webenliven.in",nocase; classtype:attempted-recon; sid:200000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aroop.in",nocase; classtype:attempted-recon; sid:200000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arris.surveysparrow.com",nocase; classtype:attempted-recon; sid:200000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrkcelebrations.in",nocase; classtype:attempted-recon; sid:200000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrtistic.com",nocase; classtype:attempted-recon; sid:200000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arsalanconstructioncompany.com",nocase; classtype:attempted-recon; sid:200000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arsantader.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemisbetguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemissbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arthamahotels.com",nocase; classtype:attempted-recon; sid:200000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"articles.investing-fund.com",nocase; classtype:attempted-recon; sid:200000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificial-connect.de",nocase; classtype:attempted-recon; sid:200000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.de",nocase; classtype:attempted-recon; sid:200000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aruba.id.gleis87.com",nocase; classtype:attempted-recon; sid:200000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asahi-life-login.com",nocase; classtype:attempted-recon; sid:200000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asahi-life.ij78.com",nocase; classtype:attempted-recon; sid:200000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascent-scaffolding.co.uk",nocase; classtype:attempted-recon; sid:200000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascom.co.tz",nocase; classtype:attempted-recon; sid:200000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aseg.gob.mx",nocase; classtype:attempted-recon; sid:200000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asf.mfvhnrt17z.workers.dev",nocase; classtype:attempted-recon; sid:200000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asgard-ampqy.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ashleygracebridal.com",nocase; classtype:attempted-recon; sid:200000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiastarchsolutions.com",nocase; classtype:attempted-recon; sid:200000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"askarmotorluaraclar.com",nocase; classtype:attempted-recon; sid:200000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asorange.fr",nocase; classtype:attempted-recon; sid:200000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asrefanavary.com",nocase; classtype:attempted-recon; sid:200000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assure.ameli.fr.buildingpermit.ae",nocase; classtype:attempted-recon; sid:200000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"astorehub.com",nocase; classtype:attempted-recon; sid:200000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"at-t-support-service1.sitey.me",nocase; classtype:attempted-recon; sid:200000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"at-t-yahoo.sitey.me",nocase; classtype:attempted-recon; sid:200000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atat005.weebly.com",nocase; classtype:attempted-recon; sid:200000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atc-saudiarabia.com",nocase; classtype:attempted-recon; sid:200000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentocaixa.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atento-fdi.plusoftomni.com.br",nocase; classtype:attempted-recon; sid:200000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ateriuj.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ativacao-online73681.com",nocase; classtype:attempted-recon; sid:200000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atlasbet725.com",nocase; classtype:attempted-recon; sid:200000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atnr76dxku336szy.clickfunnels.com",nocase; classtype:attempted-recon; sid:200000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atril2021.my-place.us",nocase; classtype:attempted-recon; sid:200000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att123yahoohd.weebly.com",nocase; classtype:attempted-recon; sid:200000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att225ig.weebly.com",nocase; classtype:attempted-recon; sid:200000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att231101service.weebly.com",nocase; classtype:attempted-recon; sid:200000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attached-file.gq",nocase; classtype:attempted-recon; sid:200000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attachit.in",nocase; classtype:attempted-recon; sid:200000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attcom-prod06a.adobecqms.net",nocase; classtype:attempted-recon; sid:200000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attgxx1v1vxxcatty.weebly.com",nocase; classtype:attempted-recon; sid:200000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailingdesk.weebly.com",nocase; classtype:attempted-recon; sid:200000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailings.weebly.com",nocase; classtype:attempted-recon; sid:200000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attmailproserver.weebly.com",nocase; classtype:attempted-recon; sid:200000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnet4.aidaform.com",nocase; classtype:attempted-recon; sid:200000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attservicesgs.heteml.net",nocase; classtype:attempted-recon; sid:200000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attsystemserviceupgrade.weebly.com",nocase; classtype:attempted-recon; sid:200000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attusersweb.weebly.com",nocase; classtype:attempted-recon; sid:200000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attverificationsupport2022.weebly.com",nocase; classtype:attempted-recon; sid:200000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizacao-online547864.com",nocase; classtype:attempted-recon; sid:200000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizacaobanestes.net",nocase; classtype:attempted-recon; sid:200000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizaonline2533.com",nocase; classtype:attempted-recon; sid:200000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizarmodolo.com",nocase; classtype:attempted-recon; sid:200000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atulrathore-dev.github.io",nocase; classtype:attempted-recon; sid:200000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atwjvv.webwave.dev",nocase; classtype:attempted-recon; sid:200000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aubootlegger.com",nocase; classtype:attempted-recon; sid:200000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.auone.jp.gemiterf.gq",nocase; classtype:attempted-recon; sid:200000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aurumship.com",nocase; classtype:attempted-recon; sid:200000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aushotel.es",nocase; classtype:attempted-recon; sid:200000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auspost.pay7649201.site",nocase; classtype:attempted-recon; sid:200000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-task1-m.web.app",nocase; classtype:attempted-recon; sid:200000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-webmailakeonetcom.yolasite.com",nocase; classtype:attempted-recon; sid:200000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth.emailserv.repl.co",nocase; classtype:attempted-recon; sid:200000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authuxeehmutconjxmailssocl.web.app",nocase; classtype:attempted-recon; sid:200000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authxntico.cc",nocase; classtype:attempted-recon; sid:200000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodetailingdelivered.info",nocase; classtype:attempted-recon; sid:200000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.gre.ac.uk",nocase; classtype:attempted-recon; sid:200000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.ryder-dutton.co.uk",nocase; classtype:attempted-recon; sid:200000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoexprs.com",nocase; classtype:attempted-recon; sid:200000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autolikesfree.net",nocase; classtype:attempted-recon; sid:200000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoranplususeremailprocessingupdate.pages.dev",nocase; classtype:attempted-recon; sid:200000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoscurt24.de",nocase; classtype:attempted-recon; sid:200000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autosrobadoschile.com",nocase; classtype:attempted-recon; sid:200000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autumn-sun-4a21.paqesads-scure.workers.dev",nocase; classtype:attempted-recon; sid:200000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auusine.com",nocase; classtype:attempted-recon; sid:200000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avadvertising.in",nocase; classtype:attempted-recon; sid:200000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avilouna.com",nocase; classtype:attempted-recon; sid:200000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avisotransacao.com",nocase; classtype:attempted-recon; sid:200000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avocatdelasacacias.com.co",nocase; classtype:attempted-recon; sid:200000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avrorganics.com",nocase; classtype:attempted-recon; sid:200000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awptdh.webwave.dev",nocase; classtype:attempted-recon; sid:200000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-y.shop",nocase; classtype:attempted-recon; sid:200000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awxzshlaj.co.vu",nocase; classtype:attempted-recon; sid:200000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ax.xiguw.workers.dev",nocase; classtype:attempted-recon; sid:200000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axe.su",nocase; classtype:attempted-recon; sid:200000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axhvjynd.paperform.co",nocase; classtype:attempted-recon; sid:200000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinity-supportwallet.com",nocase; classtype:attempted-recon; sid:200000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinity.city",nocase; classtype:attempted-recon; sid:200000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axifinity.com",nocase; classtype:attempted-recon; sid:200000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aytsport.maytsport1.com",nocase; classtype:attempted-recon; sid:200000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayushayurveda.in",nocase; classtype:attempted-recon; sid:200000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azareacomfrim.rf.gd",nocase; classtype:attempted-recon; sid:200000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azb3s.cf",nocase; classtype:attempted-recon; sid:200000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azxappscm.rf.gd",nocase; classtype:attempted-recon; sid:200000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b.com.62d0e73cec538b152393394bc325a202.enigmadesignlab.com",nocase; classtype:attempted-recon; sid:200000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b01823acb61b40448544a9545969a8bd.svc.dynamics.com",nocase; classtype:attempted-recon; sid:200000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com",nocase; classtype:attempted-recon; sid:200000640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b2bchdistribution.app.link",nocase; classtype:attempted-recon; sid:200000641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b2r6ks.cn",nocase; classtype:attempted-recon; sid:200000642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev",nocase; classtype:attempted-recon; sid:200000643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b96f7f93.sibforms.com",nocase; classtype:attempted-recon; sid:200000644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev",nocase; classtype:attempted-recon; sid:200000645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"badge-centres.ml",nocase; classtype:attempted-recon; sid:200000646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"badryassi.ch",nocase; classtype:attempted-recon; sid:200000647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bag-macben.eu",nocase; classtype:attempted-recon; sid:200000648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakerrecklaw.com",nocase; classtype:attempted-recon; sid:200000649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakhai.vn",nocase; classtype:attempted-recon; sid:200000650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"balajihospital.net",nocase; classtype:attempted-recon; sid:200000651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banbi.f.com.pe",nocase; classtype:attempted-recon; sid:200000652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banbif.com",nocase; classtype:attempted-recon; sid:200000653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banca-electronica1.odoo.com",nocase; classtype:attempted-recon; sid:200000654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaenlineape-interbark5.com",nocase; classtype:attempted-recon; sid:200000655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancalnternet-lnterbank.pe-lh.com",nocase; classtype:attempted-recon; sid:200000656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancamovil-lbk-pe.com",nocase; classtype:attempted-recon; sid:200000657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancanetinterbanks.menuenqr.net",nocase; classtype:attempted-recon; sid:200000658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-interbank.pe-logn.com",nocase; classtype:attempted-recon; sid:200000659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-netinterbankpe11.com",nocase; classtype:attempted-recon; sid:200000660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interbrnpe.com",nocase; classtype:attempted-recon; sid:200000661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbank.pronductos.com",nocase; classtype:attempted-recon; sid:200000662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporintrnet.interbnkperu.es",nocase; classtype:attempted-recon; sid:200000663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet-interbank.pe-pl.com",nocase; classtype:attempted-recon; sid:200000664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet.lnterbank.banceninternet.com",nocase; classtype:attempted-recon; sid:200000665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternetlnterbarnk.applegenius.com.br",nocase; classtype:attempted-recon; sid:200000666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaprinternet-interbank.pe-ids.com",nocase; classtype:attempted-recon; sid:200000667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancobcp.com",nocase; classtype:attempted-recon; sid:200000668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoiinng.site44.com",nocase; classtype:attempted-recon; sid:200000669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bandarjudipokerterpercaya.com",nocase; classtype:attempted-recon; sid:200000670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangpromex1.webcindario.com",nocase; classtype:attempted-recon; sid:200000671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangte008.cn",nocase; classtype:attempted-recon; sid:200000672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banistmo.com.frankopro.com",nocase; classtype:attempted-recon; sid:200000673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankapolska.com",nocase; classtype:attempted-recon; sid:200000674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banki0wa.us",nocase; classtype:attempted-recon; sid:200000675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankofamericanas.com",nocase; classtype:attempted-recon; sid:200000676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankpostal.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200000677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankpromer1ca.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bannerbank.control-inc.com",nocase; classtype:attempted-recon; sid:200000679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bannerchampnyc.com",nocase; classtype:attempted-recon; sid:200000680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baradua.it",nocase; classtype:attempted-recon; sid:200000681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"barcaenlin3a-interbark3.com",nocase; classtype:attempted-recon; sid:200000682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bas9casc3.qwe-dasd-asd.workers.dev",nocase; classtype:attempted-recon; sid:200000683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bautras.top",nocase; classtype:attempted-recon; sid:200000684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bay81studios.com",nocase; classtype:attempted-recon; sid:200000685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbbbbbtttttte.weebly.com",nocase; classtype:attempted-recon; sid:200000686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbcartoes.net",nocase; classtype:attempted-recon; sid:200000687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbncrr.webcindario.com",nocase; classtype:attempted-recon; sid:200000688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbsuporteacesso24horas.com",nocase; classtype:attempted-recon; sid:200000689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc.lbclbcpaiement.com",nocase; classtype:attempted-recon; sid:200000690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc1.paiementervice.com",nocase; classtype:attempted-recon; sid:200000691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bconclutmjy.ru",nocase; classtype:attempted-recon; sid:200000692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp-marketing.com",nocase; classtype:attempted-recon; sid:200000693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp-peru.com",nocase; classtype:attempted-recon; sid:200000694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp.world",nocase; classtype:attempted-recon; sid:200000695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpbetazonasegurabetaviabcp.com",nocase; classtype:attempted-recon; sid:200000696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpjobs.com",nocase; classtype:attempted-recon; sid:200000697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonaseguirabeta.com",nocase; classtype:attempted-recon; sid:200000698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcsnvcx.rf.gd",nocase; classtype:attempted-recon; sid:200000699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdxxmg.top",nocase; classtype:attempted-recon; sid:200000700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"be-home.web.do",nocase; classtype:attempted-recon; sid:200000701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bearmybrand.com",nocase; classtype:attempted-recon; sid:200000702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beast-blog.com",nocase; classtype:attempted-recon; sid:200000703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beatens.serveirc.com",nocase; classtype:attempted-recon; sid:200000704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautyproshop.de",nocase; classtype:attempted-recon; sid:200000705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beban.cn",nocase; classtype:attempted-recon; sid:200000706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bebe1age.com",nocase; classtype:attempted-recon; sid:200000707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beetasusgrisi.blogspot.com",nocase; classtype:attempted-recon; sid:200000708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beleza-naturais-kosmetikshop.de",nocase; classtype:attempted-recon; sid:200000709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"believed.myvnc.com",nocase; classtype:attempted-recon; sid:200000710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bellaburgementd.com",nocase; classtype:attempted-recon; sid:200000711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"belledmirmedspa.com",nocase; classtype:attempted-recon; sid:200000712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.access-blocked.info",nocase; classtype:attempted-recon; sid:200000713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.profile-locked.info",nocase; classtype:attempted-recon; sid:200000714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.review-security.info",nocase; classtype:attempted-recon; sid:200000715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigoonline.com",nocase; classtype:attempted-recon; sid:200000716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendmytrend.com",nocase; classtype:attempted-recon; sid:200000717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benhurdoud.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200000718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benjim.com",nocase; classtype:attempted-recon; sid:200000719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benrefamdksi.blogspot.com",nocase; classtype:attempted-recon; sid:200000720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bequeenspoons.com",nocase; classtype:attempted-recon; sid:200000721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berketurizm.com",nocase; classtype:attempted-recon; sid:200000722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berndurnerpa349adp8wgnsnmbad8ykr-9b3073.ingress-earth.easywp.com",nocase; classtype:attempted-recon; sid:200000723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berry-more.ru",nocase; classtype:attempted-recon; sid:200000724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"best-practice-and-impact.github.io",nocase; classtype:attempted-recon; sid:200000725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestaetigen.wpengine.com",nocase; classtype:attempted-recon; sid:200000726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestasusporgris.blogspot.com",nocase; classtype:attempted-recon; sid:200000727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbenefitsnow.life",nocase; classtype:attempted-recon; sid:200000728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestchange.ru.net",nocase; classtype:attempted-recon; sid:200000729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestchanged.ru",nocase; classtype:attempted-recon; sid:200000730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestechang.com",nocase; classtype:attempted-recon; sid:200000731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestfive.main.jp",nocase; classtype:attempted-recon; sid:200000732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestwaypools.in",nocase; classtype:attempted-recon; sid:200000733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus.club",nocase; classtype:attempted-recon; sid:200000734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus020.blogspot.com",nocase; classtype:attempted-recon; sid:200000735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus021.blogspot.com",nocase; classtype:attempted-recon; sid:200000736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus09.blogspot.com",nocase; classtype:attempted-recon; sid:200000737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus111.blogspot.com",nocase; classtype:attempted-recon; sid:200000738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus199.blogspot.com",nocase; classtype:attempted-recon; sid:200000739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2020.blogspot.com",nocase; classtype:attempted-recon; sid:200000740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2021.blogspot.com",nocase; classtype:attempted-recon; sid:200000741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus20211.blogspot.com",nocase; classtype:attempted-recon; sid:200000742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus223.blogspot.com",nocase; classtype:attempted-recon; sid:200000743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus224.blogspot.com",nocase; classtype:attempted-recon; sid:200000744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus311.blogspot.com",nocase; classtype:attempted-recon; sid:200000745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus312.blogspot.com",nocase; classtype:attempted-recon; sid:200000746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus331.blogspot.com",nocase; classtype:attempted-recon; sid:200000747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus332.blogspot.com",nocase; classtype:attempted-recon; sid:200000748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus57.blogspot.com",nocase; classtype:attempted-recon; sid:200000749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus777.blogspot.com",nocase; classtype:attempted-recon; sid:200000750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuscom.blogspot.com",nocase; classtype:attempted-recon; sid:200000751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirdi.blogspot.com",nocase; classtype:attempted-recon; sid:200000752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiri.blogspot.com",nocase; classtype:attempted-recon; sid:200000753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiris11.blogspot.com",nocase; classtype:attempted-recon; sid:200000754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi.blogspot.com",nocase; classtype:attempted-recon; sid:200000755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi3.blogspot.com",nocase; classtype:attempted-recon; sid:200000756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi4.blogspot.com",nocase; classtype:attempted-recon; sid:200000757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200000758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek.blogspot.com",nocase; classtype:attempted-recon; sid:200000759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek1.blogspot.com",nocase; classtype:attempted-recon; sid:200000760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmekicin.blogspot.com",nocase; classtype:attempted-recon; sid:200000761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirsenesende.blogspot.com",nocase; classtype:attempted-recon; sid:200000762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusguncelgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200000763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslink1.blogspot.com",nocase; classtype:attempted-recon; sid:200000764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgir.blogspot.com",nocase; classtype:attempted-recon; sid:200000765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200000766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinal1.blogspot.com",nocase; classtype:attempted-recon; sid:200000767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinals.blogspot.com",nocase; classtype:attempted-recon; sid:200000768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasussgir.blogspot.com",nocase; classtype:attempted-recon; sid:200000769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusss.blogspot.com",nocase; classtype:attempted-recon; sid:200000770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusum1.blogspot.com",nocase; classtype:attempted-recon; sid:200000771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusuyelik.com",nocase; classtype:attempted-recon; sid:200000772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betaviabcp.xyz",nocase; classtype:attempted-recon; sid:200000773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris1.blogspot.com",nocase; classtype:attempted-recon; sid:200000774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris2.blogspot.com",nocase; classtype:attempted-recon; sid:200000775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200000776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200000777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200000778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupum.blogspot.com",nocase; classtype:attempted-recon; sid:200000779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebet122.blogspot.com",nocase; classtype:attempted-recon; sid:200000780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200000781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200000782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergir4.blogspot.com",nocase; classtype:attempted-recon; sid:200000783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergiris3.blogspot.com",nocase; classtype:attempted-recon; sid:200000784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200000785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bexwebmailupdate.web.app",nocase; classtype:attempted-recon; sid:200000786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beyondoutdoor.com.au",nocase; classtype:attempted-recon; sid:200000787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beyondsmiles.co.in",nocase; classtype:attempted-recon; sid:200000788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bfnotion.ru",nocase; classtype:attempted-recon; sid:200000789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgms.cit.net",nocase; classtype:attempted-recon; sid:200000790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharathi1809.github.io",nocase; classtype:attempted-recon; sid:200000791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhavin0077.github.io",nocase; classtype:attempted-recon; sid:200000792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhbyby.cn",nocase; classtype:attempted-recon; sid:200000793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bicicentroslezama.com",nocase; classtype:attempted-recon; sid:200000794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biedronka-news.biz",nocase; classtype:attempted-recon; sid:200000795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biedronka-news.us",nocase; classtype:attempted-recon; sid:200000796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biedronkainvest.biz",nocase; classtype:attempted-recon; sid:200000797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bienesraicesinjeski.com",nocase; classtype:attempted-recon; sid:200000798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bienlinea.com",nocase; classtype:attempted-recon; sid:200000799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigboxevents.com",nocase; classtype:attempted-recon; sid:200000800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigskinscsgodota.net.ru",nocase; classtype:attempted-recon; sid:200000801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billing.servers.co.tz",nocase; classtype:attempted-recon; sid:200000802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billingfailure-o2.com",nocase; classtype:attempted-recon; sid:200000803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bimoitua.byethost6.com",nocase; classtype:attempted-recon; sid:200000804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bioenergyevitalite.com",nocase; classtype:attempted-recon; sid:200000805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biostechpos.com",nocase; classtype:attempted-recon; sid:200000806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"birlacitywaterpark.com",nocase; classtype:attempted-recon; sid:200000807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitalchile.cl",nocase; classtype:attempted-recon; sid:200000808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitbaink.web.app",nocase; classtype:attempted-recon; sid:200000809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitferronort.blogspot.com",nocase; classtype:attempted-recon; sid:200000810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitflyer66.com",nocase; classtype:attempted-recon; sid:200000811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bithunnb.web.app",nocase; classtype:attempted-recon; sid:200000812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitmexinc.com",nocase; classtype:attempted-recon; sid:200000813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bityt.me",nocase; classtype:attempted-recon; sid:200000814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizlinktek.com",nocase; classtype:attempted-recon; sid:200000815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizzcityinfo.com",nocase; classtype:attempted-recon; sid:200000816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bjewakxzbwaxrvcukkiwnrffaudmxk.22web.org",nocase; classtype:attempted-recon; sid:200000817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bjk.zagnadulte.workers.dev",nocase; classtype:attempted-recon; sid:200000818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-base.ru",nocase; classtype:attempted-recon; sid:200000819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-queen-d446.mylogindhlupdate.workers.dev",nocase; classtype:attempted-recon; sid:200000820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blanchevetements.com",nocase; classtype:attempted-recon; sid:200000821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blissful-fermi.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200000822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blockchain.com.avatardialler.com",nocase; classtype:attempted-recon; sid:200000823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blocks.rn86.ru",nocase; classtype:attempted-recon; sid:200000824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog-159650221.wp.halb.indodax.cc",nocase; classtype:attempted-recon; sid:200000825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.booxium.com",nocase; classtype:attempted-recon; sid:200000826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.drmostafafouadivf.com",nocase; classtype:attempted-recon; sid:200000827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.storrea.com",nocase; classtype:attempted-recon; sid:200000828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.visionconsulting.ro",nocase; classtype:attempted-recon; sid:200000829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.weiwanjia.com",nocase; classtype:attempted-recon; sid:200000830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blowfish-ltd.co.uk",nocase; classtype:attempted-recon; sid:200000831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluehorse.in",nocase; classtype:attempted-recon; sid:200000832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluelineassociates.org",nocase; classtype:attempted-recon; sid:200000833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnaciion.repl.co",nocase; classtype:attempted-recon; sid:200000834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnconacional.odoo.com",nocase; classtype:attempted-recon; sid:200000835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bncre.odoo.com",nocase; classtype:attempted-recon; sid:200000836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnddigital.com.br",nocase; classtype:attempted-recon; sid:200000837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bndigitalpersonas.com",nocase; classtype:attempted-recon; sid:200000838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"board.gtcounsel.com",nocase; classtype:attempted-recon; sid:200000839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boat.servequake.com",nocase; classtype:attempted-recon; sid:200000840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bogdonovlerer.com",nocase; classtype:attempted-recon; sid:200000841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-xnxx7.jkub.com",nocase; classtype:attempted-recon; sid:200000842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokepress2020.dns2.us",nocase; classtype:attempted-recon; sid:200000843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokgabanesolutions.co.za",nocase; classtype:attempted-recon; sid:200000844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bold-sun-5dd7.jim-john202020202.workers.dev",nocase; classtype:attempted-recon; sid:200000845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bolong3d.com",nocase; classtype:attempted-recon; sid:200000846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"book.com-n8wyehbph.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200000847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookfbs.evangsamuelministries.com",nocase; classtype:attempted-recon; sid:200000848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boots.ttmifeng.com",nocase; classtype:attempted-recon; sid:200000849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosland.com.my",nocase; classtype:attempted-recon; sid:200000850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bossparlayjudi.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bottesdoc.my-free.website",nocase; classtype:attempted-recon; sid:200000852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boxes.com.py",nocase; classtype:attempted-recon; sid:200000853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bper.gtradeenergy.com",nocase; classtype:attempted-recon; sid:200000854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bpl.kr",nocase; classtype:attempted-recon; sid:200000855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br194.teste.website",nocase; classtype:attempted-recon; sid:200000856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br4.in",nocase; classtype:attempted-recon; sid:200000857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br622.teste.website",nocase; classtype:attempted-recon; sid:200000858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco.ajudaempresarial.cf",nocase; classtype:attempted-recon; sid:200000859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco.ajudaparaempresas.ml",nocase; classtype:attempted-recon; sid:200000860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco.apoioparaempresas.com",nocase; classtype:attempted-recon; sid:200000861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco.suporteparaempresas.com",nocase; classtype:attempted-recon; sid:200000862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"breople.com",nocase; classtype:attempted-recon; sid:200000863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brigida_cossette.gitlab.io",nocase; classtype:attempted-recon; sid:200000864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brilliantcareer.org",nocase; classtype:attempted-recon; sid:200000865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brings.servehalflife.com",nocase; classtype:attempted-recon; sid:200000866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev",nocase; classtype:attempted-recon; sid:200000867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broken-breeze-52ae.eosprivate101.workers.dev",nocase; classtype:attempted-recon; sid:200000868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooks-factoryoutlets.com",nocase; classtype:attempted-recon; sid:200000869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooks1984.shop",nocase; classtype:attempted-recon; sid:200000870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksale.top",nocase; classtype:attempted-recon; sid:200000871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksoutletfactory.com",nocase; classtype:attempted-recon; sid:200000872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksshoess.com",nocase; classtype:attempted-recon; sid:200000873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bruno-genthial.mykajabi.com",nocase; classtype:attempted-recon; sid:200000874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brunoalmeidanet.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bsoylu.com",nocase; classtype:attempted-recon; sid:200000876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bsrmh.csb.app",nocase; classtype:attempted-recon; sid:200000877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband45654378.boxmode.io",nocase; classtype:attempted-recon; sid:200000878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband45659090xx.boxmode.io",nocase; classtype:attempted-recon; sid:200000879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadband980nfj.boxmode.io",nocase; classtype:attempted-recon; sid:200000880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands0938374746474.boxmode.io",nocase; classtype:attempted-recon; sid:200000881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands453122689.boxmode.io",nocase; classtype:attempted-recon; sid:200000882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadbands90874xx.boxmode.io",nocase; classtype:attempted-recon; sid:200000883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbroadyy02983pp.boxmode.io",nocase; classtype:attempted-recon; sid:200000884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbusinessbilling.wordpress.com",nocase; classtype:attempted-recon; sid:200000885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btclickpreview365pdf.1msite.eu",nocase; classtype:attempted-recon; sid:200000886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btcominications.boxmode.io",nocase; classtype:attempted-recon; sid:200000887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnect-109798.square.site",nocase; classtype:attempted-recon; sid:200000888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectdacsdesrf.yolasite.com",nocase; classtype:attempted-recon; sid:200000889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxinupdatetdropboxpdf-logss.yolasite.com",nocase; classtype:attempted-recon; sid:200000890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxlinkupdatetdropboxpdf-logs.yolasite.com",nocase; classtype:attempted-recon; sid:200000891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomeloginpdropboxupdatepdf-logsssss-websit.yolasite.com",nocase; classtype:attempted-recon; sid:200000892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomesloginpdropboxupdatepdf-logsssss-websi.yolasite.com",nocase; classtype:attempted-recon; sid:200000893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btddidjdjdjdd.boxmode.io",nocase; classtype:attempted-recon; sid:200000894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bthak.com",nocase; classtype:attempted-recon; sid:200000895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btincomingmailalertq7474444.boxmode.io",nocase; classtype:attempted-recon; sid:200000896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btinternetbroadbandz.boxmode.io",nocase; classtype:attempted-recon; sid:200000897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btsejrvicre.boxmode.io",nocase; classtype:attempted-recon; sid:200000898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btservererscf.boxmode.io",nocase; classtype:attempted-recon; sid:200000899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserverrf.boxmode.io",nocase; classtype:attempted-recon; sid:200000900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserverscvgh.boxmode.io",nocase; classtype:attempted-recon; sid:200000901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserversrscfed.boxmode.io",nocase; classtype:attempted-recon; sid:200000902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserversxmeixjf.boxmode.io",nocase; classtype:attempted-recon; sid:200000903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btserveruytdrxf.boxmode.io",nocase; classtype:attempted-recon; sid:200000904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btservicre.boxmode.io",nocase; classtype:attempted-recon; sid:200000905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btverificationalert3738383.boxmode.io",nocase; classtype:attempted-recon; sid:200000906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btwokrssi.weeblysite.com",nocase; classtype:attempted-recon; sid:200000907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bu1ld3rv3r1fy-s3rv3rl1st.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bucherwa.com",nocase; classtype:attempted-recon; sid:200000909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"budrimon.xyz",nocase; classtype:attempted-recon; sid:200000910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buglab.com",nocase; classtype:attempted-recon; sid:200000911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"builmon.xyz",nocase; classtype:attempted-recon; sid:200000912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bujikena.web.app",nocase; classtype:attempted-recon; sid:200000913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bum.com.ar",nocase; classtype:attempted-recon; sid:200000914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buncooo.com",nocase; classtype:attempted-recon; sid:200000915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buplan.co.uk",nocase; classtype:attempted-recon; sid:200000916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"busanopen.org",nocase; classtype:attempted-recon; sid:200000917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"businessemailss.biz",nocase; classtype:attempted-recon; sid:200000918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"busy-darwin.198-23-173-151.plesk.page",nocase; classtype:attempted-recon; sid:200000919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buyelectronicsnyc.com",nocase; classtype:attempted-recon; sid:200000920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buyonfiverr.xyz",nocase; classtype:attempted-recon; sid:200000921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bwmss.com",nocase; classtype:attempted-recon; sid:200000922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byoko.co.kr",nocase; classtype:attempted-recon; sid:200000923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byrl.me",nocase; classtype:attempted-recon; sid:200000924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byygw.csb.app",nocase; classtype:attempted-recon; sid:200000925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200000926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.aensmaoesmi.com",nocase; classtype:attempted-recon; sid:200000927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.aoeaomsnexc.com",nocase; classtype:attempted-recon; sid:200000928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.aoemsiecsan.com",nocase; classtype:attempted-recon; sid:200000929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200000930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.casscard.com",nocase; classtype:attempted-recon; sid:200000931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.coesacd.com",nocase; classtype:attempted-recon; sid:200000932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.csecoed.com",nocase; classtype:attempted-recon; sid:200000933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.curiousmorty.be",nocase; classtype:attempted-recon; sid:200000934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.jardindemiedo.es",nocase; classtype:attempted-recon; sid:200000935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.loveawaits.be",nocase; classtype:attempted-recon; sid:200000936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.mail.com",nocase; classtype:attempted-recon; sid:200000937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.mcocaei.com",nocase; classtype:attempted-recon; sid:200000938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.mmceoci.com",nocase; classtype:attempted-recon; sid:200000939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.na70.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200000940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.trofeominero.es",nocase; classtype:attempted-recon; sid:200000941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c1970424.ferozo.com",nocase; classtype:attempted-recon; sid:200000942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c2261500.ferozo.com",nocase; classtype:attempted-recon; sid:200000943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c2dc5b99.chgmar.pages.dev",nocase; classtype:attempted-recon; sid:200000944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c3cd5ac5.sibforms.com",nocase; classtype:attempted-recon; sid:200000945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c3i0y.cn",nocase; classtype:attempted-recon; sid:200000946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c5lws.app.link",nocase; classtype:attempted-recon; sid:200000947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c6ebv708.caspio.com",nocase; classtype:attempted-recon; sid:200000948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ca45645fggfi88.gb.net",nocase; classtype:attempted-recon; sid:200000949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cabonorand.com",nocase; classtype:attempted-recon; sid:200000950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cache.nebula.phx3.secureserver.net",nocase; classtype:attempted-recon; sid:200000951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cadeau-orange.fr",nocase; classtype:attempted-recon; sid:200000952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cafamiliesformidwives.cafamiliesformidwives.com",nocase; classtype:attempted-recon; sid:200000953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cafamiliesformidwives.org",nocase; classtype:attempted-recon; sid:200000954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixabank-lb.issuebook.ihsmarkit.com",nocase; classtype:attempted-recon; sid:200000955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixaseguradora.quadientcloud.com",nocase; classtype:attempted-recon; sid:200000956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cakesbyannemotha.com",nocase; classtype:attempted-recon; sid:200000957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calabogagrazing.com",nocase; classtype:attempted-recon; sid:200000958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calm-bay-082938110.azurestaticapps.net",nocase; classtype:attempted-recon; sid:200000959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calm-star-dd66.se7enmiles64.workers.dev",nocase; classtype:attempted-recon; sid:200000960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinindia.co.in",nocase; classtype:attempted-recon; sid:200000961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinsouthafrica.co.za",nocase; classtype:attempted-recon; sid:200000962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calzadosiris.com",nocase; classtype:attempted-recon; sid:200000963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"candsashjd.co.vu",nocase; classtype:attempted-recon; sid:200000964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"candsashjd.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200000965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cannellandcoflooring.co.uk",nocase; classtype:attempted-recon; sid:200000966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capacidadelivre.dynv6.net",nocase; classtype:attempted-recon; sid:200000967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capacidademail.dynv6.net",nocase; classtype:attempted-recon; sid:200000968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capservice.online",nocase; classtype:attempted-recon; sid:200000969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caracasmateriais.blogspot.com",nocase; classtype:attempted-recon; sid:200000970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cards-services-nl.45-81-232-15.plesk.page",nocase; classtype:attempted-recon; sid:200000971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carpediemxp.com",nocase; classtype:attempted-recon; sid:200000972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carwash.tv",nocase; classtype:attempted-recon; sid:200000973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casaguidi.it",nocase; classtype:attempted-recon; sid:200000974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caseforpage10003484568.web.app",nocase; classtype:attempted-recon; sid:200000975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cashaltoquebcp.com",nocase; classtype:attempted-recon; sid:200000976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casinos.bg",nocase; classtype:attempted-recon; sid:200000977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castennisacademy.be",nocase; classtype:attempted-recon; sid:200000978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catalogue-orange.com",nocase; classtype:attempted-recon; sid:200000979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cater456harys.gb.net",nocase; classtype:attempted-recon; sid:200000980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cateringfoodanddrinksupplies777.business.site",nocase; classtype:attempted-recon; sid:200000981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catherinehennig.com",nocase; classtype:attempted-recon; sid:200000982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catus.cat",nocase; classtype:attempted-recon; sid:200000983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cause.servepics.com",nocase; classtype:attempted-recon; sid:200000984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caycos.beispielseite-wmka.de",nocase; classtype:attempted-recon; sid:200000985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caymanreno.com",nocase; classtype:attempted-recon; sid:200000986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cb79624.tmweb.ru",nocase; classtype:attempted-recon; sid:200000987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbl57.csb.app",nocase; classtype:attempted-recon; sid:200000988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbmonlinegroups.com",nocase; classtype:attempted-recon; sid:200000989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ccjrlaw.com",nocase; classtype:attempted-recon; sid:200000990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cd17282.tmweb.ru",nocase; classtype:attempted-recon; sid:200000991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.via.com",nocase; classtype:attempted-recon; sid:200000992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ce02152.tmweb.ru",nocase; classtype:attempted-recon; sid:200000993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ce86129.tmweb.ru",nocase; classtype:attempted-recon; sid:200000994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cedarhomemaintenance.co.uk",nocase; classtype:attempted-recon; sid:200000995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cefempresas.com",nocase; classtype:attempted-recon; sid:200000996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet2.blogspot.com",nocase; classtype:attempted-recon; sid:200000997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet88.blogspot.com",nocase; classtype:attempted-recon; sid:200000998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets.blogspot.com",nocase; classtype:attempted-recon; sid:200000999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets2020.blogspot.com",nocase; classtype:attempted-recon; sid:200001000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cema-fossano.it",nocase; classtype:attempted-recon; sid:200001001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centralconsulta.link",nocase; classtype:attempted-recon; sid:200001002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centre1.bubbleapps.io",nocase; classtype:attempted-recon; sid:200001003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"certifica-montepaschii.com",nocase; classtype:attempted-recon; sid:200001004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cete-lem-fatura.net",nocase; classtype:attempted-recon; sid:200001005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cf47661.tmweb.ru",nocase; classtype:attempted-recon; sid:200001006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cf50l.csb.app",nocase; classtype:attempted-recon; sid:200001007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cg66264.tmweb.ru",nocase; classtype:attempted-recon; sid:200001008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cg91647.tmweb.ru",nocase; classtype:attempted-recon; sid:200001009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch-my-mtb.com",nocase; classtype:attempted-recon; sid:200001010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch-p-tracking.com",nocase; classtype:attempted-recon; sid:200001011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.ww-update.com",nocase; classtype:attempted-recon; sid:200001012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch41546.tmweb.ru",nocase; classtype:attempted-recon; sid:200001013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaimars.com",nocase; classtype:attempted-recon; sid:200001014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chanel2.work",nocase; classtype:attempted-recon; sid:200001015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaparralimages.com",nocase; classtype:attempted-recon; sid:200001016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charliebrady.duckdns.org",nocase; classtype:attempted-recon; sid:200001017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charming-gates.167-99-182-76.plesk.page",nocase; classtype:attempted-recon; sid:200001018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charperimagedesign.com",nocase; classtype:attempted-recon; sid:200001019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase5361.dns-cloud.net",nocase; classtype:attempted-recon; sid:200001020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaseonlineacces.chaseonlineaccesslogin.workers.dev",nocase; classtype:attempted-recon; sid:200001021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaseonlineaccess.chaseonlineaccesslogin.workers.dev",nocase; classtype:attempted-recon; sid:200001022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaseonlinelogin.chaseonlineaccesslogin.workers.dev",nocase; classtype:attempted-recon; sid:200001023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatasapp.com",nocase; classtype:attempted-recon; sid:200001024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsaap-group.duckdns.org",nocase; classtype:attempted-recon; sid:200001025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp-grupo-invitacion.blogspot.com",nocase; classtype:attempted-recon; sid:200001026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsappgrupjoinbokepweb.zzux.com",nocase; classtype:attempted-recon; sid:200001027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat.bisep.com.pk",nocase; classtype:attempted-recon; sid:200001028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat.zier.io",nocase; classtype:attempted-recon; sid:200001029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chateauxdechez.mtcdevserver.com",nocase; classtype:attempted-recon; sid:200001030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaturbate7.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chatwhatsappgroups11.otzo.com",nocase; classtype:attempted-recon; sid:200001032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chikkuthomas.github.io",nocase; classtype:attempted-recon; sid:200001033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chinachamber.ca",nocase; classtype:attempted-recon; sid:200001034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chinmayavidyalayarspuram.com",nocase; classtype:attempted-recon; sid:200001035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chiragrajoria.github.io",nocase; classtype:attempted-recon; sid:200001036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chirurgie-estetica.md",nocase; classtype:attempted-recon; sid:200001037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chois.jp",nocase; classtype:attempted-recon; sid:200001038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chronopostaws.com",nocase; classtype:attempted-recon; sid:200001039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chronopostweb.net",nocase; classtype:attempted-recon; sid:200001040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chudleighsolutionsltd.com",nocase; classtype:attempted-recon; sid:200001041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chutomen.com",nocase; classtype:attempted-recon; sid:200001042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chylaceous-turbine.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ciet-itac.ca",nocase; classtype:attempted-recon; sid:200001044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cihjeae.r.af.d.sendibt2.com",nocase; classtype:attempted-recon; sid:200001045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cilerakinakdeniz.com",nocase; classtype:attempted-recon; sid:200001046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cincacakamancakaman.co.vu",nocase; classtype:attempted-recon; sid:200001047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cinemaleftech.com",nocase; classtype:attempted-recon; sid:200001048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citagestionenlineabn.com",nocase; classtype:attempted-recon; sid:200001049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citapreviacr.com",nocase; classtype:attempted-recon; sid:200001050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citibank.com.vn.mcas-gov.ms",nocase; classtype:attempted-recon; sid:200001051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"city-of-jazz.de",nocase; classtype:attempted-recon; sid:200001052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cityoutlet.es",nocase; classtype:attempted-recon; sid:200001053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cjdoingthingz.com",nocase; classtype:attempted-recon; sid:200001054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ck02661.tmweb.ru",nocase; classtype:attempted-recon; sid:200001055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ck44670.tmweb.ru",nocase; classtype:attempted-recon; sid:200001056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ck54284.tmweb.ru",nocase; classtype:attempted-recon; sid:200001057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ck96076.tmweb.ru",nocase; classtype:attempted-recon; sid:200001058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckmadae.com",nocase; classtype:attempted-recon; sid:200001059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckwgruppe.service-now.com",nocase; classtype:attempted-recon; sid:200001060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim-economic0hb2s5z0qgg58i33.blogspot.com",nocase; classtype:attempted-recon; sid:200001061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim-ev3nt-ff.mypi.co",nocase; classtype:attempted-recon; sid:200001062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim-itemffgrtis48.duckdns.org",nocase; classtype:attempted-recon; sid:200001063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimcodashopmlbb.duckdns.org",nocase; classtype:attempted-recon; sid:200001064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimdiamond999.duckdns.org",nocase; classtype:attempted-recon; sid:200001065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimevent-fg.duckdns.org",nocase; classtype:attempted-recon; sid:200001066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimgratisitemff.duckdns.org",nocase; classtype:attempted-recon; sid:200001067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claims-funds-enczj.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claro-link.brsafe.com.br",nocase; classtype:attempted-recon; sid:200001069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claus.bz",nocase; classtype:attempted-recon; sid:200001070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cleaner.serveftp.com",nocase; classtype:attempted-recon; sid:200001071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.em32dat.eu",nocase; classtype:attempted-recon; sid:200001072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.pagina.email",nocase; classtype:attempted-recon; sid:200001073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"client-area-web-app.com",nocase; classtype:attempted-recon; sid:200001074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"client-web-area.com",nocase; classtype:attempted-recon; sid:200001075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientes-ingresobcp.com",nocase; classtype:attempted-recon; sid:200001076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientid-h5p8n7f9e6fbmkhbr3i4gbnia7e9zpts4nbk3ebk0zj625t2ol.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200001077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientid-ij66191jgbm96ujp40bz1gzmpc8iquhoff3ocmbrzs6g5i89t0.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200001078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clients.devtux.com",nocase; classtype:attempted-recon; sid:200001079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"climaxsolutions.com",nocase; classtype:attempted-recon; sid:200001080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clone-7473c.web.app",nocase; classtype:attempted-recon; sid:200001081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"closingdocs9480.myportfolio.com",nocase; classtype:attempted-recon; sid:200001082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud-object-storage-az-cos-static-web-hosting-rfg.s3.us-east.cloud-object-storage.appdomain.cloud",nocase; classtype:attempted-recon; sid:200001083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud-object-storage-o9-cos-static-web-hocsx2.pages.dev",nocase; classtype:attempted-recon; sid:200001084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud.go4clients.com",nocase; classtype:attempted-recon; sid:200001085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud102.hostgator.com",nocase; classtype:attempted-recon; sid:200001086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudflare-rbnuo.run.goorm.io",nocase; classtype:attempted-recon; sid:200001088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudshare-account-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudtracker.com.br",nocase; classtype:attempted-recon; sid:200001090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clt1234529.bmetrack.com",nocase; classtype:attempted-recon; sid:200001091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"club-healthylifestyle.com",nocase; classtype:attempted-recon; sid:200001092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clubeamigosdopedrosegundo.com.br",nocase; classtype:attempted-recon; sid:200001093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cmciasi.ro",nocase; classtype:attempted-recon; sid:200001094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cms.time-investments.com",nocase; classtype:attempted-recon; sid:200001095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cn19918.tmweb.ru",nocase; classtype:attempted-recon; sid:200001096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cn24c5g.cn",nocase; classtype:attempted-recon; sid:200001097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cner283829.odoo.com",nocase; classtype:attempted-recon; sid:200001098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp-services-tranid-000-00001m.31ojkpxf5.cn",nocase; classtype:attempted-recon; sid:200001099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.apvvun.cn",nocase; classtype:attempted-recon; sid:200001100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.bmldrtk.cn",nocase; classtype:attempted-recon; sid:200001101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.cik3r9.cn",nocase; classtype:attempted-recon; sid:200001102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.csfknas.cn",nocase; classtype:attempted-recon; sid:200001103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.daailrf.cn",nocase; classtype:attempted-recon; sid:200001104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.dbmwnh.cn",nocase; classtype:attempted-recon; sid:200001105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.dcrpttn.cn",nocase; classtype:attempted-recon; sid:200001106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.erarcqr.cn",nocase; classtype:attempted-recon; sid:200001107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.fcurnm.cn",nocase; classtype:attempted-recon; sid:200001108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.fjzzgxx.cn",nocase; classtype:attempted-recon; sid:200001109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.gviqly.cn",nocase; classtype:attempted-recon; sid:200001110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.ibrdwz.cn",nocase; classtype:attempted-recon; sid:200001111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.log6u0o.cn",nocase; classtype:attempted-recon; sid:200001112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.onsjnl.cn",nocase; classtype:attempted-recon; sid:200001113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.oqqstc.cn",nocase; classtype:attempted-recon; sid:200001114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.oqvbdh.cn",nocase; classtype:attempted-recon; sid:200001115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.oqzjey.cn",nocase; classtype:attempted-recon; sid:200001116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.osphky.cn",nocase; classtype:attempted-recon; sid:200001117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.pcjffai.cn",nocase; classtype:attempted-recon; sid:200001118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.phvcvgq.cn",nocase; classtype:attempted-recon; sid:200001119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.rkrabsk.cn",nocase; classtype:attempted-recon; sid:200001120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.rndgrs.cn",nocase; classtype:attempted-recon; sid:200001121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.rqqidd.cn",nocase; classtype:attempted-recon; sid:200001122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.sefdvsi.cn",nocase; classtype:attempted-recon; sid:200001123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.vguw.cn",nocase; classtype:attempted-recon; sid:200001124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.ynfmna.cn",nocase; classtype:attempted-recon; sid:200001125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.zhtckt.cn",nocase; classtype:attempted-recon; sid:200001126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co.jp.ztxzzup.cn",nocase; classtype:attempted-recon; sid:200001127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co82473.tmweb.ru",nocase; classtype:attempted-recon; sid:200001128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coanwilliams.com",nocase; classtype:attempted-recon; sid:200001129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cobabags.ru",nocase; classtype:attempted-recon; sid:200001130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cochetchristianorangefr.ctcin.bio",nocase; classtype:attempted-recon; sid:200001131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cocovip.net",nocase; classtype:attempted-recon; sid:200001132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashop-ph2020.ezua.com",nocase; classtype:attempted-recon; sid:200001133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashop-rfree6.duckdns.org",nocase; classtype:attempted-recon; sid:200001134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashops.net",nocase; classtype:attempted-recon; sid:200001135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coinchecks.cc",nocase; classtype:attempted-recon; sid:200001136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"collabland.info",nocase; classtype:attempted-recon; sid:200001137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colonialaz.cc",nocase; classtype:attempted-recon; sid:200001138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colorfastinv.com",nocase; classtype:attempted-recon; sid:200001139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiapolska.com",nocase; classtype:attempted-recon; sid:200001140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"com-f2camequur.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"com-fomn66qf.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"com-pw60aq7uu.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comigocombr.creatorlink.net",nocase; classtype:attempted-recon; sid:200001144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"commandes.site",nocase; classtype:attempted-recon; sid:200001145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-01138913366342885284.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-28202553629866144006.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.fb-pages-44883444930165123303.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.shrm.org",nocase; classtype:attempted-recon; sid:200001149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.trustwallet.com.91-218-65-223.plesk.page",nocase; classtype:attempted-recon; sid:200001150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communitystandardcenterpages.co.vu",nocase; classtype:attempted-recon; sid:200001151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communitytrustbnk.com",nocase; classtype:attempted-recon; sid:200001152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comprasnet-lbk-pe.com",nocase; classtype:attempted-recon; sid:200001153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comprensivomarrosso.edu.it",nocase; classtype:attempted-recon; sid:200001154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"computech24x7.in",nocase; classtype:attempted-recon; sid:200001155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-29.web.id",nocase; classtype:attempted-recon; sid:200001156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-33.web.id",nocase; classtype:attempted-recon; sid:200001157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-88.web.id",nocase; classtype:attempted-recon; sid:200001158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"con-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"configuration.insecur-page.workers.dev",nocase; classtype:attempted-recon; sid:200001160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"configuration.secure.facebook-accts.workers.dev",nocase; classtype:attempted-recon; sid:200001161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"configurations.reconfirm-secur.workers.dev",nocase; classtype:attempted-recon; sid:200001162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmationpageschekingidentity.co.vu",nocase; classtype:attempted-recon; sid:200001163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmczparticipante.flywheelsites.com",nocase; classtype:attempted-recon; sid:200001164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmleboncoin.ru",nocase; classtype:attempted-recon; sid:200001165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmpayment.cf",nocase; classtype:attempted-recon; sid:200001166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmsrevielapp.42web.io",nocase; classtype:attempted-recon; sid:200001167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"congresosba.com.ar",nocase; classtype:attempted-recon; sid:200001168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conhecaonlinedigital.com.br",nocase; classtype:attempted-recon; sid:200001169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conmea.diouoe.xyz",nocase; classtype:attempted-recon; sid:200001170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connect.au-login.amengsoft.com",nocase; classtype:attempted-recon; sid:200001171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connect.au-net.ne.jp.kddi-mobile549.com",nocase; classtype:attempted-recon; sid:200001172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connect.au-net.ne.jp.kddi-south.com",nocase; classtype:attempted-recon; sid:200001173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connect.auone.jp-signin.kddi-mobile549.com",nocase; classtype:attempted-recon; sid:200001174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connectwalletsdapps.com",nocase; classtype:attempted-recon; sid:200001175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conoscofaturahiiiper.com",nocase; classtype:attempted-recon; sid:200001176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conquistaguia.com.br",nocase; classtype:attempted-recon; sid:200001177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consultarextratocredi.com",nocase; classtype:attempted-recon; sid:200001178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consultervotremessagevocal.ctcin.bio",nocase; classtype:attempted-recon; sid:200001179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consulting-gvg.com",nocase; classtype:attempted-recon; sid:200001180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contabilidaderabello.com.br",nocase; classtype:attempted-recon; sid:200001181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contact2acceptpoilcyverifingyouracceptancemailfullinbox.pages.dev",nocase; classtype:attempted-recon; sid:200001182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactronin.com",nocase; classtype:attempted-recon; sid:200001183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contapessoal.digital",nocase; classtype:attempted-recon; sid:200001184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.av1.com.au",nocase; classtype:attempted-recon; sid:200001185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.cheshireimpact.com",nocase; classtype:attempted-recon; sid:200001186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.edgerockwealth.com",nocase; classtype:attempted-recon; sid:200001187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.meetmagic.org",nocase; classtype:attempted-recon; sid:200001188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.rmhc.org.nz",nocase; classtype:attempted-recon; sid:200001189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"content.warakirri.com.au",nocase; classtype:attempted-recon; sid:200001190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contratodeparceria.com.br",nocase; classtype:attempted-recon; sid:200001191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"controllo-utenti-bs.com",nocase; classtype:attempted-recon; sid:200001192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"controlloaccessoweb.com",nocase; classtype:attempted-recon; sid:200001193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cool-hat-5f34.documents-wrangler.workers.dev",nocase; classtype:attempted-recon; sid:200001194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"copayyychodasgarffa.duckdns.org",nocase; classtype:attempted-recon; sid:200001195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"copyright-fb-page26300147591.web.app",nocase; classtype:attempted-recon; sid:200001196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corecs.co",nocase; classtype:attempted-recon; sid:200001197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corewebconcepts.com",nocase; classtype:attempted-recon; sid:200001198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corporation-biedronka.us",nocase; classtype:attempted-recon; sid:200001199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corporation-orlen.us",nocase; classtype:attempted-recon; sid:200001200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corsipercorrispondenza.com",nocase; classtype:attempted-recon; sid:200001201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corta.ai",nocase; classtype:attempted-recon; sid:200001202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corvilla.id",nocase; classtype:attempted-recon; sid:200001203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cosemu.com",nocase; classtype:attempted-recon; sid:200001204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"costpify.com",nocase; classtype:attempted-recon; sid:200001205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cottonwooddentalg.nimbusweb.me",nocase; classtype:attempted-recon; sid:200001206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"couchpop.com",nocase; classtype:attempted-recon; sid:200001207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courses.cif-ifc.org",nocase; classtype:attempted-recon; sid:200001208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courtcase.co.in",nocase; classtype:attempted-recon; sid:200001209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covaricambi.it",nocase; classtype:attempted-recon; sid:200001210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-19challengecoin.com",nocase; classtype:attempted-recon; sid:200001211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-foyyn.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cox0.yolasite.com",nocase; classtype:attempted-recon; sid:200001213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cp.digitalprocurements.co.uk",nocase; classtype:attempted-recon; sid:200001214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cp45362.tmweb.ru",nocase; classtype:attempted-recon; sid:200001215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel10wh.bkk1.cloud.z.com",nocase; classtype:attempted-recon; sid:200001217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpc.cx",nocase; classtype:attempted-recon; sid:200001218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cq98210.tmweb.ru",nocase; classtype:attempted-recon; sid:200001221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cr-mufg.co",nocase; classtype:attempted-recon; sid:200001222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cranetech.com.br",nocase; classtype:attempted-recon; sid:200001223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creatingdestinycdy5.blogspot.com",nocase; classtype:attempted-recon; sid:200001224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creative-console.com",nocase; classtype:attempted-recon; sid:200001225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credcloud-object-storage-o9-cos-static-web-hocsd3d.pages.dev",nocase; classtype:attempted-recon; sid:200001226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credicorp-capital.net",nocase; classtype:attempted-recon; sid:200001227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credicorpfiduciariasa.com",nocase; classtype:attempted-recon; sid:200001228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credifinanciera.didacsis.com",nocase; classtype:attempted-recon; sid:200001229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crediserfinanza.com",nocase; classtype:attempted-recon; sid:200001230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditagricole-sudrhonealpes.blogspot.ba",nocase; classtype:attempted-recon; sid:200001231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditagricole-sudrhonealpes.blogspot.com",nocase; classtype:attempted-recon; sid:200001232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditagricole-sudrhonealpes.blogspot.ro",nocase; classtype:attempted-recon; sid:200001233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditinternationalbank.com",nocase; classtype:attempted-recon; sid:200001234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.it",nocase; classtype:attempted-recon; sid:200001235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditopessoalitau.com",nocase; classtype:attempted-recon; sid:200001236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cresvin.com",nocase; classtype:attempted-recon; sid:200001237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crgzhqafhz.cfolks.pl",nocase; classtype:attempted-recon; sid:200001238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cristalcheco.es",nocase; classtype:attempted-recon; sid:200001239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"criticalcarevizag.com",nocase; classtype:attempted-recon; sid:200001240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crm.hk-handel.com",nocase; classtype:attempted-recon; sid:200001241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crroweb.emiweb.es",nocase; classtype:attempted-recon; sid:200001242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csgopreview.net",nocase; classtype:attempted-recon; sid:200001243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csmarketm.com",nocase; classtype:attempted-recon; sid:200001244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ct65939.tmweb.ru",nocase; classtype:attempted-recon; sid:200001245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ct68074.tmweb.ru",nocase; classtype:attempted-recon; sid:200001246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ct6e.owgy.b42t.tzx2808ykhd.lflink.com",nocase; classtype:attempted-recon; sid:200001247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ctwvrvx.cn",nocase; classtype:attempted-recon; sid:200001248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlycom.odoo.com",nocase; classtype:attempted-recon; sid:200001249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlyupgrade.mystrikingly.com",nocase; classtype:attempted-recon; sid:200001250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-verification-service.cloudns.asia",nocase; classtype:attempted-recon; sid:200001251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cv45263.tmweb.ru",nocase; classtype:attempted-recon; sid:200001252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cvbnxnnxmxmx.weebly.com",nocase; classtype:attempted-recon; sid:200001253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cxmx2020atualizacao.com",nocase; classtype:attempted-recon; sid:200001254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy70456.tmweb.ru",nocase; classtype:attempted-recon; sid:200001255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy7xlpjaxh8.typeform.com",nocase; classtype:attempted-recon; sid:200001256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cybersolution.eu",nocase; classtype:attempted-recon; sid:200001257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cyrela-imoveis.blogspot.com",nocase; classtype:attempted-recon; sid:200001258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz-video.com",nocase; classtype:attempted-recon; sid:200001259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz0centrum.com",nocase; classtype:attempted-recon; sid:200001260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz84.webeden.co.uk",nocase; classtype:attempted-recon; sid:200001261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czechpost-ceska.cz.swtest.ru",nocase; classtype:attempted-recon; sid:200001262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d18gc1ytkdv37u.cloudfront.net",nocase; classtype:attempted-recon; sid:200001263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d2aae6a6.srvr-cloudmail-srvr675eu6r.pages.dev",nocase; classtype:attempted-recon; sid:200001264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d38ff0bf.ithemeshosting.com.php73-40.lan3-1.websitetestlink.com",nocase; classtype:attempted-recon; sid:200001265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d3ncuwwrr82.typeform.com",nocase; classtype:attempted-recon; sid:200001266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d521e3ba-0de3-4eae-a9a8-bafefca61eda.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200001267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d5wxk.csb.app",nocase; classtype:attempted-recon; sid:200001268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dainellistudio.eu",nocase; classtype:attempted-recon; sid:200001269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dainmigration.com",nocase; classtype:attempted-recon; sid:200001270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dalatngaynay.com",nocase; classtype:attempted-recon; sid:200001271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"damp-cell-9f51.dhlupdatedblurnt.workers.dev",nocase; classtype:attempted-recon; sid:200001272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"damp-f43e.recovery-page-secur.workers.dev",nocase; classtype:attempted-recon; sid:200001273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daniellygolden.com",nocase; classtype:attempted-recon; sid:200001274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danielwritingportfolio.com",nocase; classtype:attempted-recon; sid:200001275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danitraseoexperts.com",nocase; classtype:attempted-recon; sid:200001276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dappvalidation.net",nocase; classtype:attempted-recon; sid:200001277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darah.com.br",nocase; classtype:attempted-recon; sid:200001278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darcknetflix.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"data-correction-operation.lyqygl.shop",nocase; classtype:attempted-recon; sid:200001280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"data-protection-operation.hongjitang.top",nocase; classtype:attempted-recon; sid:200001281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"data-secure.web.id",nocase; classtype:attempted-recon; sid:200001282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dataworld.at",nocase; classtype:attempted-recon; sid:200001283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"datos-viabcpprestamo.com",nocase; classtype:attempted-recon; sid:200001284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daugiametes.lt",nocase; classtype:attempted-recon; sid:200001285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"davidshopeaz.org",nocase; classtype:attempted-recon; sid:200001286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daycoval.contrato.srv.br",nocase; classtype:attempted-recon; sid:200001287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"db-wep-mps.com",nocase; classtype:attempted-recon; sid:200001288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbesmdcjzturhizszllesbthsn-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.mc.eu1.kontiki.com",nocase; classtype:attempted-recon; sid:200001290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dcm1.ae.iwc.static.tungmung.co.id",nocase; classtype:attempted-recon; sid:200001291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dd90001.github.io",nocase; classtype:attempted-recon; sid:200001292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ddei5-0-ctp.trendmicro.com",nocase; classtype:attempted-recon; sid:200001293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deactivemsnon-8k98-l9k8-98j8-98j78u.pages.dev",nocase; classtype:attempted-recon; sid:200001294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deapplemoundo.blogspot.com",nocase; classtype:attempted-recon; sid:200001295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deborahholland.net",nocase; classtype:attempted-recon; sid:200001296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"debuil.xyz",nocase; classtype:attempted-recon; sid:200001297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decaturilbgc.com",nocase; classtype:attempted-recon; sid:200001298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decentralizedsync.com",nocase; classtype:attempted-recon; sid:200001299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declicgestion.fr",nocase; classtype:attempted-recon; sid:200001300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decorcenter.com.pe",nocase; classtype:attempted-recon; sid:200001301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deerectus.com",nocase; classtype:attempted-recon; sid:200001302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deffjamz1.weebly.com",nocase; classtype:attempted-recon; sid:200001303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"degivusep.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dejpaad.com",nocase; classtype:attempted-recon; sid:200001305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delezhen.mashalezhen.com",nocase; classtype:attempted-recon; sid:200001306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delhiescort69.com",nocase; classtype:attempted-recon; sid:200001307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delightontour.com",nocase; classtype:attempted-recon; sid:200001308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deljenjeflajera.com",nocase; classtype:attempted-recon; sid:200001309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deltaairlinecourier.com",nocase; classtype:attempted-recon; sid:200001310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demallplot-tra.web.app",nocase; classtype:attempted-recon; sid:200001311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demiregalos.com.ar",nocase; classtype:attempted-recon; sid:200001312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.bradescocontrol.vertitecnologia.com.br",nocase; classtype:attempted-recon; sid:200001313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.prunescape.com.au",nocase; classtype:attempted-recon; sid:200001314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.samretpechfinance.com",nocase; classtype:attempted-recon; sid:200001315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo2.cloudwp.dev",nocase; classtype:attempted-recon; sid:200001316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"den-brogede-verden.dk",nocase; classtype:attempted-recon; sid:200001317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denartcc.org",nocase; classtype:attempted-recon; sid:200001318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denizmessebau.com",nocase; classtype:attempted-recon; sid:200001319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dentallabor-morgenstern.de",nocase; classtype:attempted-recon; sid:200001320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denuihuongson.com.vn",nocase; classtype:attempted-recon; sid:200001321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deogharcity.com",nocase; classtype:attempted-recon; sid:200001322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-lbpayee.com",nocase; classtype:attempted-recon; sid:200001323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-unverified-seclloyd.com",nocase; classtype:attempted-recon; sid:200001324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derfs.hyperphp.com",nocase; classtype:attempted-recon; sid:200001325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designerlakehouse.com",nocase; classtype:attempted-recon; sid:200001326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designferreira.com.br",nocase; classtype:attempted-recon; sid:200001327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"desires.servemp3.com",nocase; classtype:attempted-recon; sid:200001328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"desksellcompany.com",nocase; classtype:attempted-recon; sid:200001329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dethrone.pe",nocase; classtype:attempted-recon; sid:200001330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-nadaj.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-secu-credit-union.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-www.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.ei-ie.org",nocase; classtype:attempted-recon; sid:200001334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.shivaxi.com",nocase; classtype:attempted-recon; sid:200001335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.top-snack.com",nocase; classtype:attempted-recon; sid:200001336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"devops.help",nocase; classtype:attempted-recon; sid:200001337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dexlerholdings.com",nocase; classtype:attempted-recon; sid:200001338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfastpass.com",nocase; classtype:attempted-recon; sid:200001339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dfghjkjhgfdfghjk.boxmode.io",nocase; classtype:attempted-recon; sid:200001340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhanushr24.github.io",nocase; classtype:attempted-recon; sid:200001341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-event.app",nocase; classtype:attempted-recon; sid:200001342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-ru.com",nocase; classtype:attempted-recon; sid:200001343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl.recruitmentplatform.com",nocase; classtype:attempted-recon; sid:200001344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhlsservice2021.blogspot.com",nocase; classtype:attempted-recon; sid:200001345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diamond-group.ru",nocase; classtype:attempted-recon; sid:200001346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"die-post-swiss-id-19782635812.psd2any.com",nocase; classtype:attempted-recon; sid:200001347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diginto.org",nocase; classtype:attempted-recon; sid:200001348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitalink.hu",nocase; classtype:attempted-recon; sid:200001349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dijital-superkampanya.tk",nocase; classtype:attempted-recon; sid:200001350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disappeared.servepics.com",nocase; classtype:attempted-recon; sid:200001351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discord.gift",nocase; classtype:attempted-recon; sid:200001352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discrode-gift.club",nocase; classtype:attempted-recon; sid:200001353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diskussionsforen-ebay-de.test105227.test-account.com",nocase; classtype:attempted-recon; sid:200001354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"displayplanet.pl",nocase; classtype:attempted-recon; sid:200001355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distrial.ec",nocase; classtype:attempted-recon; sid:200001356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djeliza.be",nocase; classtype:attempted-recon; sid:200001357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djsqduiildkqs.up.seesaa.net",nocase; classtype:attempted-recon; sid:200001358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb-info.com",nocase; classtype:attempted-recon; sid:200001359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb1212021support.kinsta.cloud",nocase; classtype:attempted-recon; sid:200001360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkglobaljobs.com",nocase; classtype:attempted-recon; sid:200001361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dl.9xu.com",nocase; classtype:attempted-recon; sid:200001362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlink.me",nocase; classtype:attempted-recon; sid:200001363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlw-iberica.com",nocase; classtype:attempted-recon; sid:200001364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dmaxpesca.com.es",nocase; classtype:attempted-recon; sid:200001365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dn1s29yg3m3.typeform.com",nocase; classtype:attempted-recon; sid:200001366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc.clickup.com",nocase; classtype:attempted-recon; sid:200001367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc.paragonthemes.com",nocase; classtype:attempted-recon; sid:200001368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc38347343.knorish.com",nocase; classtype:attempted-recon; sid:200001369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docketleads.com",nocase; classtype:attempted-recon; sid:200001370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doclab-console-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs-verify-c671.thajetiase.workers.dev",nocase; classtype:attempted-recon; sid:200001372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.revv.so",nocase; classtype:attempted-recon; sid:200001373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docsharex-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doctorcomboninos1adb.blogspot.com",nocase; classtype:attempted-recon; sid:200001375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"documents-secure-share-wood-42a4.vesorasa.workers.dev",nocase; classtype:attempted-recon; sid:200001376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docuservice.us",nocase; classtype:attempted-recon; sid:200001377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docusign-lnc.info",nocase; classtype:attempted-recon; sid:200001378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doghouserescue.com",nocase; classtype:attempted-recon; sid:200001379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollar-genius.com",nocase; classtype:attempted-recon; sid:200001380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollarbillsquick.com",nocase; classtype:attempted-recon; sid:200001381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domaincontroller.pmeimg.co.uk",nocase; classtype:attempted-recon; sid:200001382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dominioits.com",nocase; classtype:attempted-recon; sid:200001383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domy-serramenti.it",nocase; classtype:attempted-recon; sid:200001384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"donaldrsteele.com",nocase; classtype:attempted-recon; sid:200001385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dongsuh.net",nocase; classtype:attempted-recon; sid:200001386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dopeydog.co.nz",nocase; classtype:attempted-recon; sid:200001387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dorouscom.com",nocase; classtype:attempted-recon; sid:200001388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dotdre.com",nocase; classtype:attempted-recon; sid:200001389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dougthompsonvisuals.com",nocase; classtype:attempted-recon; sid:200001390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"douuodwoman.com",nocase; classtype:attempted-recon; sid:200001391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dowaba-s2dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200001392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"downloads.pilz.nl",nocase; classtype:attempted-recon; sid:200001393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doz.tode.cz",nocase; classtype:attempted-recon; sid:200001394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpasdasfasfasfas.pages.dev",nocase; classtype:attempted-recon; sid:200001395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-pl.53662.space",nocase; classtype:attempted-recon; sid:200001396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-pl.546773.space",nocase; classtype:attempted-recon; sid:200001397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-pl.id73743.space",nocase; classtype:attempted-recon; sid:200001398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-redelivery-uk.com",nocase; classtype:attempted-recon; sid:200001399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpdparcel-redeliver.com",nocase; classtype:attempted-recon; sid:200001400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpmasdaskj.pages.dev",nocase; classtype:attempted-recon; sid:200001401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dr-joannepeeler.com",nocase; classtype:attempted-recon; sid:200001402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drangelachamorro.com",nocase; classtype:attempted-recon; sid:200001403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreamotion-jp.com",nocase; classtype:attempted-recon; sid:200001404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dri-ve-buil-der.xyz",nocase; classtype:attempted-recon; sid:200001405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dribum.xyz",nocase; classtype:attempted-recon; sid:200001406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drivingschoolglasgow.co.uk",nocase; classtype:attempted-recon; sid:200001407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drop.gjsjhs.cn",nocase; classtype:attempted-recon; sid:200001408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drop.uk2axka.cn",nocase; classtype:attempted-recon; sid:200001409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drumoni.xyz",nocase; classtype:attempted-recon; sid:200001410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dscsusign.com",nocase; classtype:attempted-recon; sid:200001411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dsindigo.dsindigo.com.mx",nocase; classtype:attempted-recon; sid:200001412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dskedirekt.web.app",nocase; classtype:attempted-recon; sid:200001413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtpprtmwbtudyquwgytcqcthzc-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtrpsystasfasgas.pages.dev",nocase; classtype:attempted-recon; sid:200001415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dualplatecheckvalves.com",nocase; classtype:attempted-recon; sid:200001416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dukhovnist.in.ua",nocase; classtype:attempted-recon; sid:200001417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dumerobui.xyz",nocase; classtype:attempted-recon; sid:200001418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"durecorpperu.com",nocase; classtype:attempted-recon; sid:200001419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwrat.andalous.org",nocase; classtype:attempted-recon; sid:200001420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dydex.org",nocase; classtype:attempted-recon; sid:200001421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyn.co",nocase; classtype:attempted-recon; sid:200001422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dynastyclinic.ae",nocase; classtype:attempted-recon; sid:200001423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyologistica.mx",nocase; classtype:attempted-recon; sid:200001424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dzd.rksmb.org",nocase; classtype:attempted-recon; sid:200001425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-cassare.org",nocase; classtype:attempted-recon; sid:200001426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-nimi.com",nocase; classtype:attempted-recon; sid:200001427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-receipts.co",nocase; classtype:attempted-recon; sid:200001428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200001429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.aoemsiecsan.com",nocase; classtype:attempted-recon; sid:200001430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200001431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.casscard.com",nocase; classtype:attempted-recon; sid:200001432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.coesacd.com",nocase; classtype:attempted-recon; sid:200001433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.csecoed.com",nocase; classtype:attempted-recon; sid:200001434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e.mcocaei.com",nocase; classtype:attempted-recon; sid:200001435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e1sms.ir",nocase; classtype:attempted-recon; sid:200001436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e4ff557e.sso-secure-mail04wtwdw4.pages.dev",nocase; classtype:attempted-recon; sid:200001437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e4ra.byethost8.com",nocase; classtype:attempted-recon; sid:200001438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e974bu7.cn",nocase; classtype:attempted-recon; sid:200001439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eagleeyeapparel.com",nocase; classtype:attempted-recon; sid:200001440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"earth01.info",nocase; classtype:attempted-recon; sid:200001441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"earthmandesign.com",nocase; classtype:attempted-recon; sid:200001442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyholidaytrips.com",nocase; classtype:attempted-recon; sid:200001443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyquotes4you.com",nocase; classtype:attempted-recon; sid:200001444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eba0200d0c.nxcli.net",nocase; classtype:attempted-recon; sid:200001445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebadu.in",nocase; classtype:attempted-recon; sid:200001446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebaystore.shop",nocase; classtype:attempted-recon; sid:200001447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebuddynews.com",nocase; classtype:attempted-recon; sid:200001448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecaopesn.ceeeood.com",nocase; classtype:attempted-recon; sid:200001449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"echlnk0.cn",nocase; classtype:attempted-recon; sid:200001450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"echostar.pl",nocase; classtype:attempted-recon; sid:200001451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eclipsephotovoltech.com",nocase; classtype:attempted-recon; sid:200001452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; classtype:attempted-recon; sid:200001453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomuseodebicorp.com",nocase; classtype:attempted-recon; sid:200001454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edavaipro.com",nocase; classtype:attempted-recon; sid:200001455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edje.com",nocase; classtype:attempted-recon; sid:200001456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edukickmexico.com",nocase; classtype:attempted-recon; sid:200001457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-sms.co.uk",nocase; classtype:attempted-recon; sid:200001458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efarms.com.ng",nocase; classtype:attempted-recon; sid:200001459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"effect-print.net",nocase; classtype:attempted-recon; sid:200001460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efgbdfgdf.weebly.com",nocase; classtype:attempted-recon; sid:200001461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efilingtaxes.net",nocase; classtype:attempted-recon; sid:200001462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eftnotification.weebly.com",nocase; classtype:attempted-recon; sid:200001463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egacal.edu.pe",nocase; classtype:attempted-recon; sid:200001464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eggbox.top",nocase; classtype:attempted-recon; sid:200001465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egolijozinews.co.za",nocase; classtype:attempted-recon; sid:200001466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehan.org",nocase; classtype:attempted-recon; sid:200001467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eharmonyservice.com",nocase; classtype:attempted-recon; sid:200001468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehofur.com",nocase; classtype:attempted-recon; sid:200001469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekabel.hu",nocase; classtype:attempted-recon; sid:200001470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekbofexjlnsdsfaqxbcfpnfift-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekobebe.cn",nocase; classtype:attempted-recon; sid:200001472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elateengineers.com",nocase; classtype:attempted-recon; sid:200001473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electrocoolhvacr.com",nocase; classtype:attempted-recon; sid:200001474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electronicanehuen.com",nocase; classtype:attempted-recon; sid:200001475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektro-live.de",nocase; classtype:attempted-recon; sid:200001476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektroonline.pl",nocase; classtype:attempted-recon; sid:200001477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200001478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200001480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbettgiris4.blogspot.com",nocase; classtype:attempted-recon; sid:200001482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusgirisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200001483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ellatinodigital.com",nocase; classtype:attempted-recon; sid:200001484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elomo.ro",nocase; classtype:attempted-recon; sid:200001485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eluniversallatinworld.com",nocase; classtype:attempted-recon; sid:200001486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emahajobs.com",nocase; classtype:attempted-recon; sid:200001487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email-session.medville.sbs",nocase; classtype:attempted-recon; sid:200001488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.2020cycling.cc",nocase; classtype:attempted-recon; sid:200001489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.alsea.com.mx",nocase; classtype:attempted-recon; sid:200001490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.stickercanada.com",nocase; classtype:attempted-recon; sid:200001491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.touchbasepro.com",nocase; classtype:attempted-recon; sid:200001492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email302.com",nocase; classtype:attempted-recon; sid:200001493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmarketing.profesionalhosting.com",nocase; classtype:attempted-recon; sid:200001494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailsettings.webflow.io",nocase; classtype:attempted-recon; sid:200001495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailwebaccess.co.uk",nocase; classtype:attempted-recon; sid:200001496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emausradio.net",nocase; classtype:attempted-recon; sid:200001497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"embdestech.co.in",nocase; classtype:attempted-recon; sid:200001498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emebfsasampaio.creatorlink.net",nocase; classtype:attempted-recon; sid:200001499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emgmgqrq.cn",nocase; classtype:attempted-recon; sid:200001500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emjel.blogspot.com",nocase; classtype:attempted-recon; sid:200001501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emlink.me",nocase; classtype:attempted-recon; sid:200001502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emojis.bons.bar",nocase; classtype:attempted-recon; sid:200001503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emojis.dels.bar",nocase; classtype:attempted-recon; sid:200001504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas-lnterbank-peru.com",nocase; classtype:attempted-recon; sid:200001505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas-lnterlbnlk-pe.com",nocase; classtype:attempted-recon; sid:200001506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.lnterbank.cone-ccion.com",nocase; classtype:attempted-recon; sid:200001507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.xn--lnterbk-mwa.com",nocase; classtype:attempted-recon; sid:200001508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.xn--lnterbnrk-51a.com",nocase; classtype:attempted-recon; sid:200001509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.xn--lnterlbnrk-y4a.com",nocase; classtype:attempted-recon; sid:200001510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emsi-lobo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enbolivia.com",nocase; classtype:attempted-recon; sid:200001512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"encryptdrive.booogle.net",nocase; classtype:attempted-recon; sid:200001513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"endpointsportal.au-bbva-bancomerappnomina.cloud.goog",nocase; classtype:attempted-recon; sid:200001514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enemy.servehttp.com",nocase; classtype:attempted-recon; sid:200001515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"energygain.co.uk",nocase; classtype:attempted-recon; sid:200001516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"engcamp.org",nocase; classtype:attempted-recon; sid:200001517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enorma.is",nocase; classtype:attempted-recon; sid:200001518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ensemblearsmundi.com",nocase; classtype:attempted-recon; sid:200001519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ensure.3utilities.com",nocase; classtype:attempted-recon; sid:200001520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enthusiastic-herring.w5.wpsandbox.pro",nocase; classtype:attempted-recon; sid:200001521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"equalchances.org",nocase; classtype:attempted-recon; sid:200001522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erecipze.top",nocase; classtype:attempted-recon; sid:200001523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erp.oriontravels.com.bd",nocase; classtype:attempted-recon; sid:200001524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ershamshad.github.io",nocase; classtype:attempted-recon; sid:200001525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ertlh.denpasarkota.go.id",nocase; classtype:attempted-recon; sid:200001526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eschoolzones.com",nocase; classtype:attempted-recon; sid:200001527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"escortinraipur.com",nocase; classtype:attempted-recon; sid:200001528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"escpoesm.ceeeood.com",nocase; classtype:attempted-recon; sid:200001529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esfdesentakip.com",nocase; classtype:attempted-recon; sid:200001530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esgcommercialbrokers.com",nocase; classtype:attempted-recon; sid:200001531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eshetkari.com",nocase; classtype:attempted-recon; sid:200001532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esinnovativeinteriors.com",nocase; classtype:attempted-recon; sid:200001533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"espaceclientbnetvlp.solartriad.com.br",nocase; classtype:attempted-recon; sid:200001534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"espoeao.ceeeood.com",nocase; classtype:attempted-recon; sid:200001535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"essence.co.th",nocase; classtype:attempted-recon; sid:200001536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"essentia.med.br",nocase; classtype:attempted-recon; sid:200001537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"establecimientoscolonia-uy.com",nocase; classtype:attempted-recon; sid:200001538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estetika2z.com",nocase; classtype:attempted-recon; sid:200001539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estorneaqui.blogspot.com",nocase; classtype:attempted-recon; sid:200001540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estudiomaskin.com",nocase; classtype:attempted-recon; sid:200001541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-confimet.ga",nocase; classtype:attempted-recon; sid:200001542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-jp-meisai.top",nocase; classtype:attempted-recon; sid:200001543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-jpem8.ofi13.info",nocase; classtype:attempted-recon; sid:200001544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai-jp.huazongkeji.cn",nocase; classtype:attempted-recon; sid:200001545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.bamey.cn",nocase; classtype:attempted-recon; sid:200001546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jingkai15.shop",nocase; classtype:attempted-recon; sid:200001547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.stmrd.com",nocase; classtype:attempted-recon; sid:200001548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.usryvi.cn",nocase; classtype:attempted-recon; sid:200001549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.ovfu535.cn",nocase; classtype:attempted-recon; sid:200001550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.sjqqi.cn",nocase; classtype:attempted-recon; sid:200001551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.yntgrt.cn",nocase; classtype:attempted-recon; sid:200001552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.zhaopin02.shop",nocase; classtype:attempted-recon; sid:200001553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai11.shop",nocase; classtype:attempted-recon; sid:200001554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisfdf.top",nocase; classtype:attempted-recon; sid:200001555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisfr.xyz",nocase; classtype:attempted-recon; sid:200001556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisfrq.shop",nocase; classtype:attempted-recon; sid:200001557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisfrq.xyz",nocase; classtype:attempted-recon; sid:200001558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisfrr.xyz",nocase; classtype:attempted-recon; sid:200001559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k1ff.info",nocase; classtype:attempted-recon; sid:200001560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k2ff.info",nocase; classtype:attempted-recon; sid:200001561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k3ff.info",nocase; classtype:attempted-recon; sid:200001562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k4ff.info",nocase; classtype:attempted-recon; sid:200001563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k5ff.info",nocase; classtype:attempted-recon; sid:200001564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-notices.k6ff.info",nocase; classtype:attempted-recon; sid:200001565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc.marcuskeil.com",nocase; classtype:attempted-recon; sid:200001566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eth-coinwallet.net",nocase; classtype:attempted-recon; sid:200001567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eth.coinscout.cc",nocase; classtype:attempted-recon; sid:200001568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ethnictrendz.com",nocase; classtype:attempted-recon; sid:200001569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200001570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eurotecusa.com",nocase; classtype:attempted-recon; sid:200001571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eusa-lombo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evashoes.com.ua",nocase; classtype:attempted-recon; sid:200001573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eve292929.dothome.co.kr",nocase; classtype:attempted-recon; sid:200001574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventffgarena1199.duckdns.org",nocase; classtype:attempted-recon; sid:200001575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventgratisterbaru1125.duckdns.org",nocase; classtype:attempted-recon; sid:200001576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventhatyai.com",nocase; classtype:attempted-recon; sid:200001577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evento.recargajogo.me",nocase; classtype:attempted-recon; sid:200001578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventterbarugratis2022.duckdns.org",nocase; classtype:attempted-recon; sid:200001579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everestmotors.com.np",nocase; classtype:attempted-recon; sid:200001580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evershineuae.net",nocase; classtype:attempted-recon; sid:200001581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everywareshop.com",nocase; classtype:attempted-recon; sid:200001582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excel-cloud-document-2021.square.site",nocase; classtype:attempted-recon; sid:200001583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excelhana.com",nocase; classtype:attempted-recon; sid:200001584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchange4free.com",nocase; classtype:attempted-recon; sid:200001585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchangedictionary.com",nocase; classtype:attempted-recon; sid:200001586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exobus.net",nocase; classtype:attempted-recon; sid:200001587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-airdrop.com",nocase; classtype:attempted-recon; sid:200001588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-staking.web.app",nocase; classtype:attempted-recon; sid:200001589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusc.com",nocase; classtype:attempted-recon; sid:200001590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusl.com",nocase; classtype:attempted-recon; sid:200001591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduspool.io",nocase; classtype:attempted-recon; sid:200001592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodususa.net",nocase; classtype:attempted-recon; sid:200001593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduswalle-t.com",nocase; classtype:attempted-recon; sid:200001594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exondus-lokin.com",nocase; classtype:attempted-recon; sid:200001595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expiredsessions.cfd",nocase; classtype:attempted-recon; sid:200001596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exploretrace.xyz",nocase; classtype:attempted-recon; sid:200001597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"export-gret.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expressowebmail.brazilsouth.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200001599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exprizzaanddesigrill.co.uk",nocase; classtype:attempted-recon; sid:200001600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exsiccative-link.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracash-interlbankonline.com",nocase; classtype:attempted-recon; sid:200001602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracloud.com.au",nocase; classtype:attempted-recon; sid:200001603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extravasatingmetalworker.com",nocase; classtype:attempted-recon; sid:200001604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ey8jl.csb.app",nocase; classtype:attempted-recon; sid:200001605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eye-lucir.com",nocase; classtype:attempted-recon; sid:200001606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezblox.site",nocase; classtype:attempted-recon; sid:200001607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezedumalingsecuiyryt-376.web.app",nocase; classtype:attempted-recon; sid:200001608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezssausage.com",nocase; classtype:attempted-recon; sid:200001609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f.ls",nocase; classtype:attempted-recon; sid:200001610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f6fr7.codesandbox.io",nocase; classtype:attempted-recon; sid:200001611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com",nocase; classtype:attempted-recon; sid:200001612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faccebook.azurewebsites.net",nocase; classtype:attempted-recon; sid:200001613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook--videos----app----today.blogspot.com",nocase; classtype:attempted-recon; sid:200001614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-accts.pages-recovery.workers.dev",nocase; classtype:attempted-recon; sid:200001615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-login.tbit.vn",nocase; classtype:attempted-recon; sid:200001616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-1b6x8r3ep.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-coeo8hnro.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-fomn66qf.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-jtfo2odut.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-oh9wq0pzv.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com.tick-veirification-badge.hostershub.com",nocase; classtype:attempted-recon; sid:200001622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.eventspinff.wtf",nocase; classtype:attempted-recon; sid:200001623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.hrbureaugh.com",nocase; classtype:attempted-recon; sid:200001624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebookk.azurewebsites.net",nocase; classtype:attempted-recon; sid:200001625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebooks.azurewebsites.net",nocase; classtype:attempted-recon; sid:200001626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"failed.servegame.com",nocase; classtype:attempted-recon; sid:200001627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faithcitychapel.org",nocase; classtype:attempted-recon; sid:200001628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faizankhan0408.github.io",nocase; classtype:attempted-recon; sid:200001629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fallagrabadoresteve.com",nocase; classtype:attempted-recon; sid:200001630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"famili-vis.hostfree.pw",nocase; classtype:attempted-recon; sid:200001631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fancycricket11.com",nocase; classtype:attempted-recon; sid:200001632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fancydigitizing.com",nocase; classtype:attempted-recon; sid:200001633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fantech.co.il",nocase; classtype:attempted-recon; sid:200001634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fanxtv.info",nocase; classtype:attempted-recon; sid:200001635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faq.cloudfacile.com",nocase; classtype:attempted-recon; sid:200001636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faquitaindrisignature.co.vu",nocase; classtype:attempted-recon; sid:200001637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fashanddesignfunnygre.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastskins.ru.com",nocase; classtype:attempted-recon; sid:200001639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-digitalhiiper.net",nocase; classtype:attempted-recon; sid:200001640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-hiiiper-digital.net",nocase; classtype:attempted-recon; sid:200001641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faturadigiital-hiper.net",nocase; classtype:attempted-recon; sid:200001642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fax.gruppobiesse.it",nocase; classtype:attempted-recon; sid:200001643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-pages.proteksion-help.workers.dev",nocase; classtype:attempted-recon; sid:200001644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.expressturkeyi.com",nocase; classtype:attempted-recon; sid:200001645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.probox.lk",nocase; classtype:attempted-recon; sid:200001646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb7927.bget.ru",nocase; classtype:attempted-recon; sid:200001647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbidentityrecoverysecury.co.vu",nocase; classtype:attempted-recon; sid:200001648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fc.proyectosonline.xyz",nocase; classtype:attempted-recon; sid:200001649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feceboolk.blogspot.com",nocase; classtype:attempted-recon; sid:200001650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"federalaccesscredit.com",nocase; classtype:attempted-recon; sid:200001651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedex-hongkong-shipping-invoice-9ac36c.ingress-earth.easywp.com",nocase; classtype:attempted-recon; sid:200001652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedexvoyager.com",nocase; classtype:attempted-recon; sid:200001653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedner.net",nocase; classtype:attempted-recon; sid:200001654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fellmanscouriers.co.uk",nocase; classtype:attempted-recon; sid:200001655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feminine.servehalflife.com",nocase; classtype:attempted-recon; sid:200001656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fer-brooks.top",nocase; classtype:attempted-recon; sid:200001657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ferienhof-gempel.de",nocase; classtype:attempted-recon; sid:200001658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fertinose.rocks",nocase; classtype:attempted-recon; sid:200001659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ff-membershipp-garenaa.online",nocase; classtype:attempted-recon; sid:200001660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ffmembergarenavz.github.io",nocase; classtype:attempted-recon; sid:200001661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fghjr74rhudfguhtfguji.blogspot.com",nocase; classtype:attempted-recon; sid:200001662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgwedf.peradi7014.workers.dev",nocase; classtype:attempted-recon; sid:200001663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhadigital.net",nocase; classtype:attempted-recon; sid:200001664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhfhrddf.weebly.com",nocase; classtype:attempted-recon; sid:200001665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhhw1u.webwave.dev",nocase; classtype:attempted-recon; sid:200001666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fi.uy",nocase; classtype:attempted-recon; sid:200001667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; classtype:attempted-recon; sid:200001668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fightclubamerica.com",nocase; classtype:attempted-recon; sid:200001669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fighting40s.com",nocase; classtype:attempted-recon; sid:200001670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fik.vs2p4dquni6283.workers.dev",nocase; classtype:attempted-recon; sid:200001671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fileundelete.net",nocase; classtype:attempted-recon; sid:200001672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filsafat.stahnmpukuturan.ac.id",nocase; classtype:attempted-recon; sid:200001673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filtrosmil.com.br",nocase; classtype:attempted-recon; sid:200001674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finalfantasyguide.co.uk",nocase; classtype:attempted-recon; sid:200001675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financiallifecoaching.builderallwp.com",nocase; classtype:attempted-recon; sid:200001676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financieracredicorpltda.com",nocase; classtype:attempted-recon; sid:200001677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finanzgrp-kreisspark-bank3.xyz",nocase; classtype:attempted-recon; sid:200001678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finanzgrp-kreisspark-bank6.xyz",nocase; classtype:attempted-recon; sid:200001679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findrealtors.tv",nocase; classtype:attempted-recon; sid:200001680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstladyofcountry.com",nocase; classtype:attempted-recon; sid:200001681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstobmen.live",nocase; classtype:attempted-recon; sid:200001682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fisika.fmipa.unila.ac.id",nocase; classtype:attempted-recon; sid:200001683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiteram.eliotek.net",nocase; classtype:attempted-recon; sid:200001684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"five23.io",nocase; classtype:attempted-recon; sid:200001685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixi.rest",nocase; classtype:attempted-recon; sid:200001686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixingtodaymailuserupdates.pages.dev",nocase; classtype:attempted-recon; sid:200001687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fkjew07.cn",nocase; classtype:attempted-recon; sid:200001688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flawlessplants.com",nocase; classtype:attempted-recon; sid:200001689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flladv.com.br",nocase; classtype:attempted-recon; sid:200001690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"floabkclt3.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200001691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fluksrv.mycpanel.rs",nocase; classtype:attempted-recon; sid:200001692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flyerblaster.com",nocase; classtype:attempted-recon; sid:200001693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fm.registrobarretos.com.br",nocase; classtype:attempted-recon; sid:200001694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fmdraft.benstacey.ca",nocase; classtype:attempted-recon; sid:200001695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foamnflow.com",nocase; classtype:attempted-recon; sid:200001696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"focar.vn",nocase; classtype:attempted-recon; sid:200001697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foliar.pl",nocase; classtype:attempted-recon; sid:200001698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foma-ura-lote.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forcedtoupdate.safetyamazonprotection.work",nocase; classtype:attempted-recon; sid:200001700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foresta-mod.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formbuddy.com",nocase; classtype:attempted-recon; sid:200001702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formedarteitalia.com",nocase; classtype:attempted-recon; sid:200001703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.formium.io",nocase; classtype:attempted-recon; sid:200001704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formtools.com",nocase; classtype:attempted-recon; sid:200001705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forumasik.com",nocase; classtype:attempted-recon; sid:200001706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forums.rstools.club",nocase; classtype:attempted-recon; sid:200001707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fosnetsecuritycameras.com",nocase; classtype:attempted-recon; sid:200001708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fpmaam.org",nocase; classtype:attempted-recon; sid:200001709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fq2wsad.lapar83986.workers.dev",nocase; classtype:attempted-recon; sid:200001710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fr-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200001711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fr.movieproxy.com",nocase; classtype:attempted-recon; sid:200001712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fraenkly-speaking.de",nocase; classtype:attempted-recon; sid:200001713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frankfurtertsparkasse.web.app",nocase; classtype:attempted-recon; sid:200001714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frankqvo.surveysparrow.com",nocase; classtype:attempted-recon; sid:200001715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-firecoderedem.blogspot.com",nocase; classtype:attempted-recon; sid:200001716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freefire.pontorecargajogo.com",nocase; classtype:attempted-recon; sid:200001717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freefire27thang3.com",nocase; classtype:attempted-recon; sid:200001718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeliker.net",nocase; classtype:attempted-recon; sid:200001719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeproductkey.org",nocase; classtype:attempted-recon; sid:200001720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freg-nine.pt",nocase; classtype:attempted-recon; sid:200001721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frerfire-gaming.mrbonus.com",nocase; classtype:attempted-recon; sid:200001722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"friendsofnechockey.com",nocase; classtype:attempted-recon; sid:200001723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fruernes.dk",nocase; classtype:attempted-recon; sid:200001724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftgttgsjwj.duckdns.org",nocase; classtype:attempted-recon; sid:200001725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-ca.com",nocase; classtype:attempted-recon; sid:200001726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-exchangex.com",nocase; classtype:attempted-recon; sid:200001727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-me.com",nocase; classtype:attempted-recon; sid:200001728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register-pro.world",nocase; classtype:attempted-recon; sid:200001729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register-site.com",nocase; classtype:attempted-recon; sid:200001730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.biz",nocase; classtype:attempted-recon; sid:200001731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.store",nocase; classtype:attempted-recon; sid:200001732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-register.website",nocase; classtype:attempted-recon; sid:200001733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx-signup.click",nocase; classtype:attempted-recon; sid:200001734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx.com.vn",nocase; classtype:attempted-recon; sid:200001735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx.cool",nocase; classtype:attempted-recon; sid:200001736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftx.idwebsite.me",nocase; classtype:attempted-recon; sid:200001737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftxbonus.site",nocase; classtype:attempted-recon; sid:200001738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftxcrypton.com",nocase; classtype:attempted-recon; sid:200001739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuad.iainkendari.ac.id",nocase; classtype:attempted-recon; sid:200001740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"funiswap.exchange",nocase; classtype:attempted-recon; sid:200001741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"furnitureplus.com.pk",nocase; classtype:attempted-recon; sid:200001742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fusionsportsclub.com",nocase; classtype:attempted-recon; sid:200001743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"future.servehalflife.com",nocase; classtype:attempted-recon; sid:200001744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"futuretroveschool.com",nocase; classtype:attempted-recon; sid:200001745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuygphr.procreattive.com",nocase; classtype:attempted-recon; sid:200001746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fwq.widet69219.workers.dev",nocase; classtype:attempted-recon; sid:200001747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxhalifax.com",nocase; classtype:attempted-recon; sid:200001748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxt27.csb.app",nocase; classtype:attempted-recon; sid:200001749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxxmpavktyihgyqitmuaimubui-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fzbfhn.webwave.dev",nocase; classtype:attempted-recon; sid:200001751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g-mtcc.com",nocase; classtype:attempted-recon; sid:200001752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ga.teesmith.shop",nocase; classtype:attempted-recon; sid:200001753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gabrielamims.com",nocase; classtype:attempted-recon; sid:200001754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gakrvwufrvhxjaabezdbltlhff-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gameofbet.org",nocase; classtype:attempted-recon; sid:200001756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gardeniahotel.in",nocase; classtype:attempted-recon; sid:200001757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garena-hadiah-999.duckdns.org",nocase; classtype:attempted-recon; sid:200001758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garena-xacminhtaikhoan.com",nocase; classtype:attempted-recon; sid:200001759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garena.recargajogo.me",nocase; classtype:attempted-recon; sid:200001760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garenafreefire20000.duckdns.org",nocase; classtype:attempted-recon; sid:200001761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gator4203.temp.domains",nocase; classtype:attempted-recon; sid:200001762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gchronics.com",nocase; classtype:attempted-recon; sid:200001763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gedfdfsd.eu",nocase; classtype:attempted-recon; sid:200001764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"geg.li",nocase; classtype:attempted-recon; sid:200001765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generali-italia-ag.hrweb.it",nocase; classtype:attempted-recon; sid:200001766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generationalkidz.com",nocase; classtype:attempted-recon; sid:200001767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"genie-alba.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"george-atef.com",nocase; classtype:attempted-recon; sid:200001769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"germackpistachio.com",nocase; classtype:attempted-recon; sid:200001770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getapps.vip",nocase; classtype:attempted-recon; sid:200001771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getauto.cnar.win",nocase; classtype:attempted-recon; sid:200001772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getitapprovedacceptourterms2021.pages.dev",nocase; classtype:attempted-recon; sid:200001773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getlikesfree.com",nocase; classtype:attempted-recon; sid:200001774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getmagic.app",nocase; classtype:attempted-recon; sid:200001775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getpayment-irs.serveirc.com",nocase; classtype:attempted-recon; sid:200001776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getrealreview.com",nocase; classtype:attempted-recon; sid:200001777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfxx.creatorlink.net",nocase; classtype:attempted-recon; sid:200001778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ggzq1poyuhzp.wixsite.com",nocase; classtype:attempted-recon; sid:200001779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghislain.dartois.pagesperso-orange.fr",nocase; classtype:attempted-recon; sid:200001780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gibertoni.it",nocase; classtype:attempted-recon; sid:200001781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giftboxsolutions.xyz",nocase; classtype:attempted-recon; sid:200001782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giftcards.allomoncoco.com",nocase; classtype:attempted-recon; sid:200001783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gigsmartllc.nyweblinks.com",nocase; classtype:attempted-recon; sid:200001784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giris-papara.net",nocase; classtype:attempted-recon; sid:200001785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girlsgroupwhtsapponlysexxy.xxuz.com",nocase; classtype:attempted-recon; sid:200001786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gite-lafage.com",nocase; classtype:attempted-recon; sid:200001787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"give-pancakeswap.com",nocase; classtype:attempted-recon; sid:200001788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gjfgjrwtet.work",nocase; classtype:attempted-recon; sid:200001789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gkjx168.com",nocase; classtype:attempted-recon; sid:200001790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gkkxqnbkqbyhwjnthriuzevtzarrvf.22web.org",nocase; classtype:attempted-recon; sid:200001791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glamournailsbyleda.com",nocase; classtype:attempted-recon; sid:200001793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glogo.org",nocase; classtype:attempted-recon; sid:200001794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glomediamarketinginstitute.com",nocase; classtype:attempted-recon; sid:200001795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gls-pakke-dk.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glsword.com",nocase; classtype:attempted-recon; sid:200001797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gm-xaktualisierungmail.yolasite.com",nocase; classtype:attempted-recon; sid:200001798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmailposteingangi.de",nocase; classtype:attempted-recon; sid:200001799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmgroupllc.co",nocase; classtype:attempted-recon; sid:200001800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-aktualisierung.yolasite.com",nocase; classtype:attempted-recon; sid:200001801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-mail-net.yolasite.com",nocase; classtype:attempted-recon; sid:200001802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxaktualisierungmail.yolasite.com",nocase; classtype:attempted-recon; sid:200001803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxchrismyfderna.yolasite.com",nocase; classtype:attempted-recon; sid:200001804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxmailme.yolasite.com",nocase; classtype:attempted-recon; sid:200001805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go-analytics.paineldemonstrativo.com.br",nocase; classtype:attempted-recon; sid:200001806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.simplify.co.nz",nocase; classtype:attempted-recon; sid:200001807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go24link.com",nocase; classtype:attempted-recon; sid:200001808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goforsolar.in",nocase; classtype:attempted-recon; sid:200001809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gofreegovernmentmoney.com",nocase; classtype:attempted-recon; sid:200001810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldenlasgidi10.web.app",nocase; classtype:attempted-recon; sid:200001811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golfballsonline.com",nocase; classtype:attempted-recon; sid:200001812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golfpost.themecloud.dev",nocase; classtype:attempted-recon; sid:200001813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golkondaresorts.com",nocase; classtype:attempted-recon; sid:200001814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gonzalo009.gotdns.ch",nocase; classtype:attempted-recon; sid:200001815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo-gl.me",nocase; classtype:attempted-recon; sid:200001816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"good12345.tripod.com",nocase; classtype:attempted-recon; sid:200001817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gooresult1-1-daycovalfinanc.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200001818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorgeousgetaways.com",nocase; classtype:attempted-recon; sid:200001819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorin-monoffre.fr",nocase; classtype:attempted-recon; sid:200001820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gornjimilanovac.rs",nocase; classtype:attempted-recon; sid:200001821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorrolandiaperu.com",nocase; classtype:attempted-recon; sid:200001822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosafes.com",nocase; classtype:attempted-recon; sid:200001823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosalair.com",nocase; classtype:attempted-recon; sid:200001824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"govkn.knorish.com",nocase; classtype:attempted-recon; sid:200001825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gpbom.codesandbox.io",nocase; classtype:attempted-recon; sid:200001826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grab.zenstream.com",nocase; classtype:attempted-recon; sid:200001827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"graficastoral.com",nocase; classtype:attempted-recon; sid:200001828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandbettinggir2.blogspot.com",nocase; classtype:attempted-recon; sid:200001829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandfather.servebeer.com",nocase; classtype:attempted-recon; sid:200001830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greaterlovefoundation.org",nocase; classtype:attempted-recon; sid:200001831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greatmusica.com",nocase; classtype:attempted-recon; sid:200001832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greekfunnycontestadnikee.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greekinfra.com",nocase; classtype:attempted-recon; sid:200001834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greenfieldsproperty.com.au",nocase; classtype:attempted-recon; sid:200001835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gregmounsey.com",nocase; classtype:attempted-recon; sid:200001836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gripseld.com",nocase; classtype:attempted-recon; sid:200001837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grosshandel-mevida.de",nocase; classtype:attempted-recon; sid:200001838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"group-18-sans.wikaba.com",nocase; classtype:attempted-recon; sid:200001839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groworldinternational.com",nocase; classtype:attempted-recon; sid:200001840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grub-newwhatsappmabar.duckdns.org",nocase; classtype:attempted-recon; sid:200001841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubbokep22.mrbonus.com",nocase; classtype:attempted-recon; sid:200001842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubtante-vvip1.forumz.info",nocase; classtype:attempted-recon; sid:200001843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-bokep-18xx.duckdns.org",nocase; classtype:attempted-recon; sid:200001844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-wa-bokep18.wikaba.com",nocase; classtype:attempted-recon; sid:200001845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-whatsapp-video-viral.duckdns.org",nocase; classtype:attempted-recon; sid:200001846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-whatsappsexy.xxuz.com",nocase; classtype:attempted-recon; sid:200001847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupjoin-freexs8f.duckdns.org",nocase; classtype:attempted-recon; sid:200001848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupoabi.cl",nocase; classtype:attempted-recon; sid:200001849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupobazcolombia.com",nocase; classtype:attempted-recon; sid:200001850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupofsp.com.br",nocase; classtype:attempted-recon; sid:200001851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupopromeric.webcindario.com",nocase; classtype:attempted-recon; sid:200001852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruposanpio.com",nocase; classtype:attempted-recon; sid:200001853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruposcherman.com.br",nocase; classtype:attempted-recon; sid:200001854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupp-okep-21-my.duckdns.org",nocase; classtype:attempted-recon; sid:200001855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruppp-21-new-xzy.duckdns.org",nocase; classtype:attempted-recon; sid:200001856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupppwasexxx.duckdns.org",nocase; classtype:attempted-recon; sid:200001857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwa18-tys.wikaba.com",nocase; classtype:attempted-recon; sid:200001858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gscommunityspirit.greenschool.org",nocase; classtype:attempted-recon; sid:200001859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gsdpublicidad.net",nocase; classtype:attempted-recon; sid:200001860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guard-int-checks-nomination.trycloudflare.com",nocase; classtype:attempted-recon; sid:200001861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guardofferte.com",nocase; classtype:attempted-recon; sid:200001862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guje.weebly.com",nocase; classtype:attempted-recon; sid:200001863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gunntree.com.elameraland.com",nocase; classtype:attempted-recon; sid:200001864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gurukanth.com",nocase; classtype:attempted-recon; sid:200001865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"guscho.ru",nocase; classtype:attempted-recon; sid:200001866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwenet.org",nocase; classtype:attempted-recon; sid:200001867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwisalltrack.com",nocase; classtype:attempted-recon; sid:200001868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwred.4ik87425pj-354refd.workers.dev",nocase; classtype:attempted-recon; sid:200001869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h218-ipv4-45-94-0.mynet.it",nocase; classtype:attempted-recon; sid:200001870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5brzd.webwave.dev",nocase; classtype:attempted-recon; sid:200001871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; classtype:attempted-recon; sid:200001872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"habbocreditosparati.blogspot.com",nocase; classtype:attempted-recon; sid:200001873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hadjangkjaattnetlinknfbji.weebly.com",nocase; classtype:attempted-recon; sid:200001874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hahdaeupdate.es.tl",nocase; classtype:attempted-recon; sid:200001875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haileysart.com",nocase; classtype:attempted-recon; sid:200001876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halaisabudhabi.com",nocase; classtype:attempted-recon; sid:200001877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"half-lifetimes.com",nocase; classtype:attempted-recon; sid:200001878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-securelink.com",nocase; classtype:attempted-recon; sid:200001879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halisdurum.com",nocase; classtype:attempted-recon; sid:200001880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haliuk-secure-device.com",nocase; classtype:attempted-recon; sid:200001881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"handakai.github.io",nocase; classtype:attempted-recon; sid:200001882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hans-ledlite.com",nocase; classtype:attempted-recon; sid:200001883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"happened.servehalflife.com",nocase; classtype:attempted-recon; sid:200001884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hardcore-perlman.91-190-155-120.plesk.page",nocase; classtype:attempted-recon; sid:200001885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haroldhazard1-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200001886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasseanhannitybeenwaterboarded.com",nocase; classtype:attempted-recon; sid:200001887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haunlimited.org",nocase; classtype:attempted-recon; sid:200001888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hbbzjy.com",nocase; classtype:attempted-recon; sid:200001889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hcnprdvz.azureedge.net",nocase; classtype:attempted-recon; sid:200001890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hdhctc.cn",nocase; classtype:attempted-recon; sid:200001891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hdmediahub.club",nocase; classtype:attempted-recon; sid:200001892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"healthylifestylesecrets.mobi",nocase; classtype:attempted-recon; sid:200001893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heart.serveftp.com",nocase; classtype:attempted-recon; sid:200001894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heavens.ddnsking.com",nocase; classtype:attempted-recon; sid:200001895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heinthu1.github.io",nocase; classtype:attempted-recon; sid:200001896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helindo.id",nocase; classtype:attempted-recon; sid:200001897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helloparis.co.uk",nocase; classtype:attempted-recon; sid:200001898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-center-notice-comunity-6532.web.id",nocase; classtype:attempted-recon; sid:200001899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-center-notice-comunity-657.web.id",nocase; classtype:attempted-recon; sid:200001900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-notice-center-identity-6532.web.id",nocase; classtype:attempted-recon; sid:200001901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help.confirm-page-notification.help-page.workers.dev",nocase; classtype:attempted-recon; sid:200001902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help.nertworek.pagereconfirm.workers.dev",nocase; classtype:attempted-recon; sid:200001903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help.validation-page.workers.dev",nocase; classtype:attempted-recon; sid:200001904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpaccountpagescenter-2021.tk",nocase; classtype:attempted-recon; sid:200001905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpcentercoomunitystandards.co.vu",nocase; classtype:attempted-recon; sid:200001906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpdesk-tech.com",nocase; classtype:attempted-recon; sid:200001907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppss-validtionss131wq.gq",nocase; classtype:attempted-recon; sid:200001908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpsupportidentityisentlost.co.vu",nocase; classtype:attempted-recon; sid:200001909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heppler.ch.net2care.com",nocase; classtype:attempted-recon; sid:200001910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsbahis01.blogspot.com",nocase; classtype:attempted-recon; sid:200001911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahiis1.blogspot.com",nocase; classtype:attempted-recon; sid:200001912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200001914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200001915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetershaven.net",nocase; classtype:attempted-recon; sid:200001916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetrios.com.br",nocase; classtype:attempted-recon; sid:200001917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heuristic-lehmann.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200001918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hgaeruowarewsrhyeodtj.xyz",nocase; classtype:attempted-recon; sid:200001919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhfjjehnnnmkkfjnmmju.odoo.com",nocase; classtype:attempted-recon; sid:200001920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hi.switchy.io",nocase; classtype:attempted-recon; sid:200001921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hidzzs.com",nocase; classtype:attempted-recon; sid:200001922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"higufytdfghlk98.weeblysite.com",nocase; classtype:attempted-recon; sid:200001923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hikari-rigell.com",nocase; classtype:attempted-recon; sid:200001924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"himalayansherpa.com.au",nocase; classtype:attempted-recon; sid:200001925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hiper-fatura.azurewebsites.net",nocase; classtype:attempted-recon; sid:200001926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitman71hd-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200001927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hjkfj.ml",nocase; classtype:attempted-recon; sid:200001928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hm.ru",nocase; classtype:attempted-recon; sid:200001929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmlkl.codesandbox.io",nocase; classtype:attempted-recon; sid:200001930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hnhz7.csb.app",nocase; classtype:attempted-recon; sid:200001931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hockian.com",nocase; classtype:attempted-recon; sid:200001932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hof-barth.de",nocase; classtype:attempted-recon; sid:200001933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hogarin.com",nocase; classtype:attempted-recon; sid:200001934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holidaysforme.in",nocase; classtype:attempted-recon; sid:200001935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holiganguncelgir.blogspot.com",nocase; classtype:attempted-recon; sid:200001936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home-interbankperuon.yanape-co.com",nocase; classtype:attempted-recon; sid:200001937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.bt-account-info.com",nocase; classtype:attempted-recon; sid:200001938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.ei1ns.de",nocase; classtype:attempted-recon; sid:200001939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.myfairpoint.net",nocase; classtype:attempted-recon; sid:200001940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homebtyty31.boxmode.io",nocase; classtype:attempted-recon; sid:200001941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homegrown.dynastyapp.org",nocase; classtype:attempted-recon; sid:200001942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homesinlogin.com",nocase; classtype:attempted-recon; sid:200001943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hometowns.ddnsking.com",nocase; classtype:attempted-recon; sid:200001944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honeyband.com.au",nocase; classtype:attempted-recon; sid:200001945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hopeforfuture.org.in",nocase; classtype:attempted-recon; sid:200001946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"horahoremartuis.co.vu",nocase; classtype:attempted-recon; sid:200001947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hortcri.bussnesmttengadscrop.link",nocase; classtype:attempted-recon; sid:200001948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostemio.xyz",nocase; classtype:attempted-recon; sid:200001949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2070987.online.pro",nocase; classtype:attempted-recon; sid:200001950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostnix.net",nocase; classtype:attempted-recon; sid:200001951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.1200028f.net2care.com",nocase; classtype:attempted-recon; sid:200001952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.121c0291.net2care.com",nocase; classtype:attempted-recon; sid:200001953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.17a902ef.tcorner.fr",nocase; classtype:attempted-recon; sid:200001954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.hebetec.ch.p2aexpertise.com",nocase; classtype:attempted-recon; sid:200001955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotbrooks.com",nocase; classtype:attempted-recon; sid:200001956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotel-pontos.gr",nocase; classtype:attempted-recon; sid:200001957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelratanpalace.com",nocase; classtype:attempted-recon; sid:200001958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelsanantonio.com.mx",nocase; classtype:attempted-recon; sid:200001959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelsinkaraikal.com",nocase; classtype:attempted-recon; sid:200001960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotgrub.mlbb732.ga",nocase; classtype:attempted-recon; sid:200001961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hounbvc-c7661.web.app",nocase; classtype:attempted-recon; sid:200001962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"howeverted.com",nocase; classtype:attempted-recon; sid:200001963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"howrse.5v.pl",nocase; classtype:attempted-recon; sid:200001964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hoynoticias.com.ar",nocase; classtype:attempted-recon; sid:200001965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpplotters.in",nocase; classtype:attempted-recon; sid:200001967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrs-game.main.jp",nocase; classtype:attempted-recon; sid:200001968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-19982318.t.hubspotfree.net",nocase; classtype:attempted-recon; sid:200001969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-giveaways.ca",nocase; classtype:attempted-recon; sid:200001970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht-cargo.com.vn",nocase; classtype:attempted-recon; sid:200001971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpeugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200001974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpfacebook.com-4qrtlm4x3.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpfacebook.com-hzh4b0pj1i.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpfacebook.com-zxsrf038k.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpmarketplace.facebook.com-4n2v2b3j.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpmarketplace.facebook.com-ifwfkouvn.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.appcompleto.dynv6.net",nocase; classtype:attempted-recon; sid:200001980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-recoveruuid47846655621480518600.z8qipcdmdq-95m32qpwk3rv.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"https.pages-recoveruuid99035839557343250535.z8qipcdmdq-95m32qpwk3rv.p.runcloud.link",nocase; classtype:attempted-recon; sid:200001982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-0m4mp6wmex.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-4n2v2b3j.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-hzh4b0pj1i.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsfacebook.com-j706zmy49r.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsgmx-upgrade-verification-admin-updates-websitess-website.yolasite.com",nocase; classtype:attempted-recon; sid:200001987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsmarketplace.facebook.com-8rztsmhoq.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsmarketplace.facebook.com-izkbuxmx.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"htuukxbhvqrpbkttakftpiaiyuyzffart.fast-page.org",nocase; classtype:attempted-recon; sid:200001990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hu.2021store.ru",nocase; classtype:attempted-recon; sid:200001991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huispeter.be",nocase; classtype:attempted-recon; sid:200001992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200001993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200001994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu.sitey.me",nocase; classtype:attempted-recon; sid:200001995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humanity06.com",nocase; classtype:attempted-recon; sid:200001996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humc.in",nocase; classtype:attempted-recon; sid:200001997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hutoknepper.de",nocase; classtype:attempted-recon; sid:200001998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huynguyen2k.github.io",nocase; classtype:attempted-recon; sid:200001999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hydratrader.com",nocase; classtype:attempted-recon; sid:200002000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hydtddz.com",nocase; classtype:attempted-recon; sid:200002001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hypegames.shop",nocase; classtype:attempted-recon; sid:200002002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hypegamesonline.site",nocase; classtype:attempted-recon; sid:200002003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hzbaxe.cn",nocase; classtype:attempted-recon; sid:200002004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hzhygw.cn",nocase; classtype:attempted-recon; sid:200002005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-ask332.dga.jp",nocase; classtype:attempted-recon; sid:200002006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ialvkqkadlmcdltczoqpwoociz-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iamwatch.net",nocase; classtype:attempted-recon; sid:200002008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibkinterbankper.com",nocase; classtype:attempted-recon; sid:200002009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibkprestamoimediatoapp.com",nocase; classtype:attempted-recon; sid:200002010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibpm.ru",nocase; classtype:attempted-recon; sid:200002011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iccglobalinc.com",nocase; classtype:attempted-recon; sid:200002012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iclloudo.xyz",nocase; classtype:attempted-recon; sid:200002013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icloud-map-live.com",nocase; classtype:attempted-recon; sid:200002014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icy-mud-45aa.admin6854.workers.dev",nocase; classtype:attempted-recon; sid:200002015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"id-pour-vous-identifier-sur-votre-compte.yolasite.com",nocase; classtype:attempted-recon; sid:200002016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"id.posten.no-login.prohoster.biz",nocase; classtype:attempted-recon; sid:200002017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idam-web-public.aat.platform.hmcts.net",nocase; classtype:attempted-recon; sid:200002018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-mescomptesv1.cf",nocase; classtype:attempted-recon; sid:200002019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-principalev1.cf",nocase; classtype:attempted-recon; sid:200002020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identifiez-vous-avec-votre-compte.yolasite.com",nocase; classtype:attempted-recon; sid:200002021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identifiez-vous598.yolasite.com",nocase; classtype:attempted-recon; sid:200002022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identify.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idhuman-verification.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idiomas247.com",nocase; classtype:attempted-recon; sid:200002025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idylicintroductions.com",nocase; classtype:attempted-recon; sid:200002026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iframejld.avent-media.fr",nocase; classtype:attempted-recon; sid:200002027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igamingmediahub.com",nocase; classtype:attempted-recon; sid:200002028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ighk.08o3okp2jp.workers.dev",nocase; classtype:attempted-recon; sid:200002029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ighk.umjlrs7uci2751.workers.dev",nocase; classtype:attempted-recon; sid:200002030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igtechnologyspa.cl",nocase; classtype:attempted-recon; sid:200002031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iipvit.by",nocase; classtype:attempted-recon; sid:200002032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikn.g4cep0ceih9501.workers.dev",nocase; classtype:attempted-recon; sid:200002033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikulutugrowthacademy.com",nocase; classtype:attempted-recon; sid:200002034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"illuminated.servegame.com",nocase; classtype:attempted-recon; sid:200002035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imhpackaging.com",nocase; classtype:attempted-recon; sid:200002036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imobiliaria-cardinali-com-br.blogspot.com",nocase; classtype:attempted-recon; sid:200002037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impotspublicservice.com",nocase; classtype:attempted-recon; sid:200002038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imsva91-ctp.trendmicro.com",nocase; classtype:attempted-recon; sid:200002039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"in-truck.dk",nocase; classtype:attempted-recon; sid:200002040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"in.deraya.org",nocase; classtype:attempted-recon; sid:200002041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"incosapanama.com",nocase; classtype:attempted-recon; sid:200002042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indianvaastu.com",nocase; classtype:attempted-recon; sid:200002043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infic.net",nocase; classtype:attempted-recon; sid:200002044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-full18.2waky.com",nocase; classtype:attempted-recon; sid:200002045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.ipromoteuoffers.com",nocase; classtype:attempted-recon; sid:200002046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.lionnets.com",nocase; classtype:attempted-recon; sid:200002047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infodeseguros.com",nocase; classtype:attempted-recon; sid:200002048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infokid.softwareelite.com",nocase; classtype:attempted-recon; sid:200002049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informations.recovery.confiryourpage.workers.dev",nocase; classtype:attempted-recon; sid:200002050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosecplace.com",nocase; classtype:attempted-recon; sid:200002051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosprologinmatrisemomols.yolasite.com",nocase; classtype:attempted-recon; sid:200002052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingaveiculos.creatorlink.net",nocase; classtype:attempted-recon; sid:200002053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingdirectes.com",nocase; classtype:attempted-recon; sid:200002054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingresobcpclientes-peru.com",nocase; classtype:attempted-recon; sid:200002055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inhhxzgaikwezzywgdxgykmkpzmqri.22web.org",nocase; classtype:attempted-recon; sid:200002056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inicia-bancalnterbank.com",nocase; classtype:attempted-recon; sid:200002057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inkmaster.cloud",nocase; classtype:attempted-recon; sid:200002058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl-3dsecure.dostawa-id.live",nocase; classtype:attempted-recon; sid:200002059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.53662.space",nocase; classtype:attempted-recon; sid:200002060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.clear-id.xyz",nocase; classtype:attempted-recon; sid:200002061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.oplata24.space",nocase; classtype:attempted-recon; sid:200002062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost.oficjalna-pl.site",nocase; classtype:attempted-recon; sid:200002063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inps-ep.com",nocase; classtype:attempted-recon; sid:200002064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inrjimna.ga",nocase; classtype:attempted-recon; sid:200002065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insaafenterprisesinc.com",nocase; classtype:attempted-recon; sid:200002066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram-redirect-login.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagramhelpp.agency",nocase; classtype:attempted-recon; sid:200002068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagrm-bluebadge-supportcenter.ml",nocase; classtype:attempted-recon; sid:200002069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"institutodefaveri.com",nocase; classtype:attempted-recon; sid:200002070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insuminet.hostfree.pw",nocase; classtype:attempted-recon; sid:200002071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intellidata-analytica.com",nocase; classtype:attempted-recon; sid:200002072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahis452.blogspot.com",nocase; classtype:attempted-recon; sid:200002073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirin.blogspot.com",nocase; classtype:attempted-recon; sid:200002074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirisadresimiz2.blogspot.com",nocase; classtype:attempted-recon; sid:200002075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200002076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbank.seguros.com.ve",nocase; classtype:attempted-recon; sid:200002077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbankalerta.com",nocase; classtype:attempted-recon; sid:200002078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbankempresas.pe-il.ru",nocase; classtype:attempted-recon; sid:200002079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbanklyanapayperu.efect-pe.com",nocase; classtype:attempted-recon; sid:200002080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbanknet.nom.pe",nocase; classtype:attempted-recon; sid:200002081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbanyanapayperu.efect-pe.com",nocase; classtype:attempted-recon; sid:200002082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intergirisi.blogspot.com",nocase; classtype:attempted-recon; sid:200002083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interiorsbis.com",nocase; classtype:attempted-recon; sid:200002084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intern.unibas-com.ch",nocase; classtype:attempted-recon; sid:200002085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"international-formulier.91-218-65-223.plesk.page",nocase; classtype:attempted-recon; sid:200002086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"international-services.ni6132741-1.web19.nitrado.hosting",nocase; classtype:attempted-recon; sid:200002087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internem.be",nocase; classtype:attempted-recon; sid:200002088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internetservicetech.com",nocase; classtype:attempted-recon; sid:200002089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internordia.com",nocase; classtype:attempted-recon; sid:200002090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intesabanca-onlinesicura.com",nocase; classtype:attempted-recon; sid:200002091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intexargentina.com.ar",nocase; classtype:attempted-recon; sid:200002092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inthewildproductions.com",nocase; classtype:attempted-recon; sid:200002093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intranet.sztpe.info",nocase; classtype:attempted-recon; sid:200002094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"investpl.work",nocase; classtype:attempted-recon; sid:200002095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inviopp.checktrc.icu",nocase; classtype:attempted-recon; sid:200002096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.inbox.lv",nocase; classtype:attempted-recon; sid:200002097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ionclnc.tk",nocase; classtype:attempted-recon; sid:200002098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.info",nocase; classtype:attempted-recon; sid:200002099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipod.co.za",nocase; classtype:attempted-recon; sid:200002100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irenterprises.in",nocase; classtype:attempted-recon; sid:200002101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irfgbfxigraqcpgbaiwzqynzeeekab.22web.org",nocase; classtype:attempted-recon; sid:200002102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irn-inc.com",nocase; classtype:attempted-recon; sid:200002103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-homepage.serveirc.com",nocase; classtype:attempted-recon; sid:200002104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-refund-status.com",nocase; classtype:attempted-recon; sid:200002105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.claim-tax.pkbmngudikapinteran.sch.id",nocase; classtype:attempted-recon; sid:200002106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-aid-taxus.com",nocase; classtype:attempted-recon; sid:200002107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-aids-reliefs.com",nocase; classtype:attempted-recon; sid:200002108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-aids-reliefsusa.com",nocase; classtype:attempted-recon; sid:200002109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-claimads-us.com",nocase; classtype:attempted-recon; sid:200002110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-reliefsonline.com",nocase; classtype:attempted-recon; sid:200002111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.home-tax-usreliefs.com",nocase; classtype:attempted-recon; sid:200002112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.homepage-usareliefs.com",nocase; classtype:attempted-recon; sid:200002113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.profile-tax-usacompentsation.com",nocase; classtype:attempted-recon; sid:200002114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irsgov.pro",nocase; classtype:attempted-recon; sid:200002115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstds.com",nocase; classtype:attempted-recon; sid:200002116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isfirsatibul.com",nocase; classtype:attempted-recon; sid:200002117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"issc345enter.gb.net",nocase; classtype:attempted-recon; sid:200002118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"istudyalumni.com",nocase; classtype:attempted-recon; sid:200002119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-friedli.ch",nocase; classtype:attempted-recon; sid:200002121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-supportdesk.com",nocase; classtype:attempted-recon; sid:200002122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it.melnikhotels.com",nocase; classtype:attempted-recon; sid:200002123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itcentralsupport.net",nocase; classtype:attempted-recon; sid:200002124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itdelivery.trcttparcel.top",nocase; classtype:attempted-recon; sid:200002125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iteegom.iteego.repl.co",nocase; classtype:attempted-recon; sid:200002126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itiy.in",nocase; classtype:attempted-recon; sid:200002127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itoxtsor.click",nocase; classtype:attempted-recon; sid:200002128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itryratan.com",nocase; classtype:attempted-recon; sid:200002129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"its.tikkycloud.com",nocase; classtype:attempted-recon; sid:200002130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itsmdshahin.github.io",nocase; classtype:attempted-recon; sid:200002131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuhkj.r4f4vmtlso.workers.dev",nocase; classtype:attempted-recon; sid:200002132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iutdigne.free.fr",nocase; classtype:attempted-recon; sid:200002133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"izcalttia.com",nocase; classtype:attempted-recon; sid:200002134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j6rdc0.webwave.dev",nocase; classtype:attempted-recon; sid:200002135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j8s9kk.cn",nocase; classtype:attempted-recon; sid:200002136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jabnshop.com",nocase; classtype:attempted-recon; sid:200002137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jacco.co.jp-service-tranid-jalg00001-00m.yt6lq.cn",nocase; classtype:attempted-recon; sid:200002138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccsivr.vmenu.jp",nocase; classtype:attempted-recon; sid:200002139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-service-tranid-000-00001.7h6gxcxd.cn",nocase; classtype:attempted-recon; sid:200002140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-service-tranid-0001m.dtncf4r.cn",nocase; classtype:attempted-recon; sid:200002141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-00001m.1rtzr7v.cn",nocase; classtype:attempted-recon; sid:200002142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-00001m.37nrklj0p.cn",nocase; classtype:attempted-recon; sid:200002143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-00001m.386lieby2.cn",nocase; classtype:attempted-recon; sid:200002144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-00001m.vjw6b3v.cn",nocase; classtype:attempted-recon; sid:200002145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-00001m.wbesqfa.cn",nocase; classtype:attempted-recon; sid:200002146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccss.co.jp-services-tranid-000-0001m.tfjq8md76i.cn",nocase; classtype:attempted-recon; sid:200002147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jackbinaspuol.blogspot.com",nocase; classtype:attempted-recon; sid:200002148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jackrussellsforsale.com",nocase; classtype:attempted-recon; sid:200002149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jacobliston.com",nocase; classtype:attempted-recon; sid:200002150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jadaart.org",nocase; classtype:attempted-recon; sid:200002151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jadebest.ru",nocase; classtype:attempted-recon; sid:200002152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jadev.tk",nocase; classtype:attempted-recon; sid:200002153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jam-023d.gitlab.io",nocase; classtype:attempted-recon; sid:200002154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"james8.aidaform.com",nocase; classtype:attempted-recon; sid:200002155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jamesonpcapitalgroup.com",nocase; classtype:attempted-recon; sid:200002156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jandakaya.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"javarockingland.com",nocase; classtype:attempted-recon; sid:200002158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jazzpeace.top",nocase; classtype:attempted-recon; sid:200002159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jcb.jcbng.cn",nocase; classtype:attempted-recon; sid:200002160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jcb08.com",nocase; classtype:attempted-recon; sid:200002161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jctuitiononline.com.sg",nocase; classtype:attempted-recon; sid:200002162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jdhhhfffhh.weebly.com",nocase; classtype:attempted-recon; sid:200002163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jellyphotocopy.info",nocase; classtype:attempted-recon; sid:200002164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jerinja.github.io",nocase; classtype:attempted-recon; sid:200002165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jerrabomberratennisclub.com.au",nocase; classtype:attempted-recon; sid:200002166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jetser-electrical-supply.business.site",nocase; classtype:attempted-recon; sid:200002167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jett.gator.site",nocase; classtype:attempted-recon; sid:200002168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jflkp.csb.app",nocase; classtype:attempted-recon; sid:200002169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jfovukvysqnglcjghfxncklqih-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jhkruirt.com",nocase; classtype:attempted-recon; sid:200002171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jhkruirt.net",nocase; classtype:attempted-recon; sid:200002172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jindaltextiles.com",nocase; classtype:attempted-recon; sid:200002173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiwanramchemical.com",nocase; classtype:attempted-recon; sid:200002174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jk3bt83s.r.eu-west-1.awstrack.me",nocase; classtype:attempted-recon; sid:200002175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jkshvnijkf.weebly.com",nocase; classtype:attempted-recon; sid:200002176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jlogine.com",nocase; classtype:attempted-recon; sid:200002177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"job-side.com",nocase; classtype:attempted-recon; sid:200002178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joe23.aidaform.com",nocase; classtype:attempted-recon; sid:200002179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joecamera.net",nocase; classtype:attempted-recon; sid:200002180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joeypmemorialfoundation.com",nocase; classtype:attempted-recon; sid:200002181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"john-ashley.de",nocase; classtype:attempted-recon; sid:200002182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-whatsappk8wh.xxuz.com",nocase; classtype:attempted-recon; sid:200002183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joindewasa.qpoe.com",nocase; classtype:attempted-recon; sid:200002184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingroup2.myz.info",nocase; classtype:attempted-recon; sid:200002185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingrup-whatsapp393.duckdns.org",nocase; classtype:attempted-recon; sid:200002186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joudialbarat.blogspot.com",nocase; classtype:attempted-recon; sid:200002187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joyeriajireh.com.mx",nocase; classtype:attempted-recon; sid:200002188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp-mercari.in",nocase; classtype:attempted-recon; sid:200002189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp-service-tranid-000-00001.7n9l15hpl.cn",nocase; classtype:attempted-recon; sid:200002190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.cbvxjac.cn",nocase; classtype:attempted-recon; sid:200002191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.goxxntk.cn",nocase; classtype:attempted-recon; sid:200002192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mercarl.xyz",nocase; classtype:attempted-recon; sid:200002193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.smurieoctrem.cn",nocase; classtype:attempted-recon; sid:200002194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jptechdocsign.net",nocase; classtype:attempted-recon; sid:200002195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrhayley.plus.com",nocase; classtype:attempted-recon; sid:200002196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jsbyv.app.link",nocase; classtype:attempted-recon; sid:200002197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jstrieb.github.io",nocase; classtype:attempted-recon; sid:200002198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jszxdp.com",nocase; classtype:attempted-recon; sid:200002199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jthdfgqwf.sxoa-ifdxey.gq",nocase; classtype:attempted-recon; sid:200002200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtrjergbs.sxoa-ifdxey.gq",nocase; classtype:attempted-recon; sid:200002201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ju8y0u5.cn",nocase; classtype:attempted-recon; sid:200002202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juandfar.github.io",nocase; classtype:attempted-recon; sid:200002203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juangoico.com",nocase; classtype:attempted-recon; sid:200002204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juanthradio.com",nocase; classtype:attempted-recon; sid:200002205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"julianhbonline.com",nocase; classtype:attempted-recon; sid:200002206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jurlebedev.ru",nocase; classtype:attempted-recon; sid:200002207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justgot.gonevis.com",nocase; classtype:attempted-recon; sid:200002208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justsayingbro.com",nocase; classtype:attempted-recon; sid:200002209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvjvfg.tk",nocase; classtype:attempted-recon; sid:200002210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvk.zultifarza.workers.dev",nocase; classtype:attempted-recon; sid:200002211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvrlbxq.cn",nocase; classtype:attempted-recon; sid:200002212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jyaseru.com",nocase; classtype:attempted-recon; sid:200002213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jz2bab.webwave.dev",nocase; classtype:attempted-recon; sid:200002214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k3ja6d.webwave.dev",nocase; classtype:attempted-recon; sid:200002215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k4je4zal.yolasite.com",nocase; classtype:attempted-recon; sid:200002216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kaamwalibais.co.in",nocase; classtype:attempted-recon; sid:200002217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kanctovari33.ru",nocase; classtype:attempted-recon; sid:200002218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kargonova.com",nocase; classtype:attempted-recon; sid:200002219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartarky-online.cz",nocase; classtype:attempted-recon; sid:200002220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartclue.com",nocase; classtype:attempted-recon; sid:200002221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbl-ltd.co.jp",nocase; classtype:attempted-recon; sid:200002222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbstitchdesigns.com",nocase; classtype:attempted-recon; sid:200002223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbx1orln7nj.typeform.com",nocase; classtype:attempted-recon; sid:200002224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kcpoddar.in",nocase; classtype:attempted-recon; sid:200002225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdbp6lzwnk.sisekuden0b0pinaycess.com",nocase; classtype:attempted-recon; sid:200002226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kddi-mobile549.com",nocase; classtype:attempted-recon; sid:200002227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdlscaffolding.co.uk",nocase; classtype:attempted-recon; sid:200002228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecbearings.com",nocase; classtype:attempted-recon; sid:200002229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecc.com",nocase; classtype:attempted-recon; sid:200002230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecmanijada.com",nocase; classtype:attempted-recon; sid:200002231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keep-passw0rd-supp0rt20211129-0106.supp0rtaaqkadq2zgnizte3ltbly2etnge5yi05ntm3lty2yjcwyzywzdjhmwa.workers.dev",nocase; classtype:attempted-recon; sid:200002232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepactive-8k98-l9k8-98j8-98j78u-d3d3-fr3d34d-2.pages.dev",nocase; classtype:attempted-recon; sid:200002233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepboxactive-msoe3e3-osd2rrf432-d342f4-3f34e32edetferef.pages.dev",nocase; classtype:attempted-recon; sid:200002234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepspiritdesign.com",nocase; classtype:attempted-recon; sid:200002235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepyourupdatesafe.weebly.com",nocase; classtype:attempted-recon; sid:200002236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kennel-buffing.com",nocase; classtype:attempted-recon; sid:200002237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kevinsmovingservice.com",nocase; classtype:attempted-recon; sid:200002238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"key-drcp.com",nocase; classtype:attempted-recon; sid:200002239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keyboardtreasures.com",nocase; classtype:attempted-recon; sid:200002240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kghm-invest.web.app",nocase; classtype:attempted-recon; sid:200002241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kgruzdvor.com",nocase; classtype:attempted-recon; sid:200002242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kh3wfp6f.easy.co",nocase; classtype:attempted-recon; sid:200002243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ki89.pckmlc0cus5667.workers.dev",nocase; classtype:attempted-recon; sid:200002244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kienthucykhoa.org",nocase; classtype:attempted-recon; sid:200002245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kihoku-familabo.jp",nocase; classtype:attempted-recon; sid:200002246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kilshi.com",nocase; classtype:attempted-recon; sid:200002247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kind-hypatia.45-81-232-15.plesk.page",nocase; classtype:attempted-recon; sid:200002248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kingfaisalprize.org",nocase; classtype:attempted-recon; sid:200002249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kingspizza.co.uk",nocase; classtype:attempted-recon; sid:200002250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kissapps.io",nocase; classtype:attempted-recon; sid:200002251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kit.mishkanhakavana.com",nocase; classtype:attempted-recon; sid:200002252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kitagaslagi1.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjsa.com",nocase; classtype:attempted-recon; sid:200002254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klockorochsmycken.se",nocase; classtype:attempted-recon; sid:200002255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"km4o0.codesandbox.io",nocase; classtype:attempted-recon; sid:200002256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koerich-c-empresarial.com",nocase; classtype:attempted-recon; sid:200002257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kolkatafusion.com",nocase; classtype:attempted-recon; sid:200002258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kom-ma.de",nocase; classtype:attempted-recon; sid:200002259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kompashka.com.ua",nocase; classtype:attempted-recon; sid:200002260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konami-uefa-euro.net",nocase; classtype:attempted-recon; sid:200002261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kontoopdatering.appleld.dk.opdatering.dspbrand.com",nocase; classtype:attempted-recon; sid:200002263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koskas.activehosted.com",nocase; classtype:attempted-recon; sid:200002264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koteng.odoo.com",nocase; classtype:attempted-recon; sid:200002265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kovolem.cz",nocase; classtype:attempted-recon; sid:200002266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kp.kralenexpres.nl",nocase; classtype:attempted-recon; sid:200002267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kqmthev.cluster030.hosting.ovh.net",nocase; classtype:attempted-recon; sid:200002268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kr-bithumb.web.app",nocase; classtype:attempted-recon; sid:200002269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kraftonfree.com",nocase; classtype:attempted-recon; sid:200002270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krakenrums.blogspot.com",nocase; classtype:attempted-recon; sid:200002271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kropiwnicki.com.pl",nocase; classtype:attempted-recon; sid:200002272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ksamaids.com",nocase; classtype:attempted-recon; sid:200002273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kscdcg.webwave.dev",nocase; classtype:attempted-recon; sid:200002274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kso-bw-bank-online.u1492093.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200002275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ksschool.org.in",nocase; classtype:attempted-recon; sid:200002276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kuchkuchnights.com",nocase; classtype:attempted-recon; sid:200002277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kulgar-jacpot.duckdns.org",nocase; classtype:attempted-recon; sid:200002278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kulikovets.ru",nocase; classtype:attempted-recon; sid:200002279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kunsilindustry.com",nocase; classtype:attempted-recon; sid:200002280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurortnoye.com.ua",nocase; classtype:attempted-recon; sid:200002281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kw.yourcarkw.com",nocase; classtype:attempted-recon; sid:200002282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kykpcympjcnvwnwngqfryptwkijmyw.22web.org",nocase; classtype:attempted-recon; sid:200002283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyuram.conohawing.com",nocase; classtype:attempted-recon; sid:200002284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l-q.in",nocase; classtype:attempted-recon; sid:200002285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l1heladeria.cl",nocase; classtype:attempted-recon; sid:200002286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l1zuo.codesandbox.io",nocase; classtype:attempted-recon; sid:200002287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labellacalabria.co.uk",nocase; classtype:attempted-recon; sid:200002288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labore-ma.blogspot.com",nocase; classtype:attempted-recon; sid:200002289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labpenjasfkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200002290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lacarrere.com",nocase; classtype:attempted-recon; sid:200002291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laconejasp.cl",nocase; classtype:attempted-recon; sid:200002292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ladyemprezz.com",nocase; classtype:attempted-recon; sid:200002293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lagrutahotel.com",nocase; classtype:attempted-recon; sid:200002294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lakp.pl",nocase; classtype:attempted-recon; sid:200002295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lamaison.bc.ca",nocase; classtype:attempted-recon; sid:200002296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lamanabatelekemebe.duckdns.org",nocase; classtype:attempted-recon; sid:200002297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapekbugii55.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapiraterieestla.wixsite.com",nocase; classtype:attempted-recon; sid:200002299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laposada.roncesvalles.es",nocase; classtype:attempted-recon; sid:200002300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapotosinaexpress.com",nocase; classtype:attempted-recon; sid:200002301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larindbr.creatorlink.net",nocase; classtype:attempted-recon; sid:200002302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larvalab.to",nocase; classtype:attempted-recon; sid:200002303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lascarseguridad.cl",nocase; classtype:attempted-recon; sid:200002304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lashibifuneralhomes.com",nocase; classtype:attempted-recon; sid:200002305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lastbackup.com.au",nocase; classtype:attempted-recon; sid:200002306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lasyaja.github.io",nocase; classtype:attempted-recon; sid:200002307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"late-rev-sparka-2021.xyz",nocase; classtype:attempted-recon; sid:200002308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lateroffer.com",nocase; classtype:attempted-recon; sid:200002309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latinotravel.cz",nocase; classtype:attempted-recon; sid:200002310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latmasoud.persiangig.com",nocase; classtype:attempted-recon; sid:200002311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laviealondres.com",nocase; classtype:attempted-recon; sid:200002312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lawasartantique.com",nocase; classtype:attempted-recon; sid:200002313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbcpzonaseguraonline.yanabpay.com",nocase; classtype:attempted-recon; sid:200002314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ldsplanettt.yolasite.com",nocase; classtype:attempted-recon; sid:200002315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"le-diablotin-rouen.com",nocase; classtype:attempted-recon; sid:200002316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leadershipmail.org",nocase; classtype:attempted-recon; sid:200002317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leaguecsg.com",nocase; classtype:attempted-recon; sid:200002318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"learningimpactmodel.com",nocase; classtype:attempted-recon; sid:200002319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leb.trancleboncoinve.com",nocase; classtype:attempted-recon; sid:200002320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin-paiement-secure.rf.gd",nocase; classtype:attempted-recon; sid:200002321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin-paiementsecured.paperform.co",nocase; classtype:attempted-recon; sid:200002322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin.la",nocase; classtype:attempted-recon; sid:200002323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinconnect.ru",nocase; classtype:attempted-recon; sid:200002324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinpaiement.cf",nocase; classtype:attempted-recon; sid:200002325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinsecupaiement.paperform.co",nocase; classtype:attempted-recon; sid:200002326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lecoursiervouslivrerapidement.org",nocase; classtype:attempted-recon; sid:200002327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lefsb.csb.app",nocase; classtype:attempted-recon; sid:200002328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lenagruessdich.net",nocase; classtype:attempted-recon; sid:200002329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lerocice1911.blogspot.com",nocase; classtype:attempted-recon; sid:200002330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"letsjumpnj.com",nocase; classtype:attempted-recon; sid:200002331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lexiurisbarna.com",nocase; classtype:attempted-recon; sid:200002332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lexnotes.com.ng",nocase; classtype:attempted-recon; sid:200002333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lg-onecom-io.web.app",nocase; classtype:attempted-recon; sid:200002334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lgcopyriightglobal.ml",nocase; classtype:attempted-recon; sid:200002335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lgxiyq.cn",nocase; classtype:attempted-recon; sid:200002336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"library.foraqsa.com",nocase; classtype:attempted-recon; sid:200002337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liezen-online.at",nocase; classtype:attempted-recon; sid:200002338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"life-is-journey-pages.my.id",nocase; classtype:attempted-recon; sid:200002339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lifequestonline.com",nocase; classtype:attempted-recon; sid:200002340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lightlink.com.cn",nocase; classtype:attempted-recon; sid:200002341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.cc",nocase; classtype:attempted-recon; sid:200002342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.com",nocase; classtype:attempted-recon; sid:200002343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"likecreeper.com",nocase; classtype:attempted-recon; sid:200002344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"line9922.xyz",nocase; classtype:attempted-recon; sid:200002345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linesoe.github.io",nocase; classtype:attempted-recon; sid:200002346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lirc.cep.edu.vn",nocase; classtype:attempted-recon; sid:200002347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lit-shelf-49914.herokuapp.com",nocase; classtype:attempted-recon; sid:200002348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"little-frost-1a15.chrisc11004842.workers.dev",nocase; classtype:attempted-recon; sid:200002349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"little-rain-39c4.newdhlacceslogins.workers.dev",nocase; classtype:attempted-recon; sid:200002350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"little-wood-23ca.abssupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200002351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liucras.helppindosadsgrow.link",nocase; classtype:attempted-recon; sid:200002352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liusanchuan.github.io",nocase; classtype:attempted-recon; sid:200002353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live-site.hopto.me",nocase; classtype:attempted-recon; sid:200002354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live.rawfednews.com",nocase; classtype:attempted-recon; sid:200002355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livecryptolab.com",nocase; classtype:attempted-recon; sid:200002356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lizardpedia.com",nocase; classtype:attempted-recon; sid:200002357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lladrousa.com",nocase; classtype:attempted-recon; sid:200002358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-accountbreach.com",nocase; classtype:attempted-recon; sid:200002359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-devicehelp.com",nocase; classtype:attempted-recon; sid:200002360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-secure-customers.com",nocase; classtype:attempted-recon; sid:200002361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-support-team.com",nocase; classtype:attempted-recon; sid:200002362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbanking-securelogin.com",nocase; classtype:attempted-recon; sid:200002363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-online-i87349019.com",nocase; classtype:attempted-recon; sid:200002364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.deregister-payee-secure-auth.com",nocase; classtype:attempted-recon; sid:200002365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-online-deregister.com",nocase; classtype:attempted-recon; sid:200002366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-personal-device-login.com",nocase; classtype:attempted-recon; sid:200002367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyduk-newdevice-registered-online.com",nocase; classtype:attempted-recon; sid:200002368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"llsckhuhskcamuqwbonsrhwpvk-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lms.ozyegin.edu.tr",nocase; classtype:attempted-recon; sid:200002370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.dev",nocase; classtype:attempted-recon; sid:200002371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnpost.buyplatform-infome.xyz",nocase; classtype:attempted-recon; sid:200002372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbancape-lbk.com",nocase; classtype:attempted-recon; sid:200002373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbankempresas.oh-prime.com",nocase; classtype:attempted-recon; sid:200002374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkhome.weworldnews.com",nocase; classtype:attempted-recon; sid:200002375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterlbanlkweb.oh-prime.com",nocase; classtype:attempted-recon; sid:200002376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"localbusinesscitationbuilding.com",nocase; classtype:attempted-recon; sid:200002377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"location-check.gb.net",nocase; classtype:attempted-recon; sid:200002378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"location3-1e6f6.web.app",nocase; classtype:attempted-recon; sid:200002379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lofon-add.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-a5x1ir9bkd0dfo9nrbe2akijf3ux35u2gard0djpitipusxxc8.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200002381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-bank.org",nocase; classtype:attempted-recon; sid:200002382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-live.com-s02.net",nocase; classtype:attempted-recon; sid:200002383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-np6hh1hdf6csg7hcskopd44b7e7z4clqa8lput68g5abukevka.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200002384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-onlinebanking-suntrust-olb.net",nocase; classtype:attempted-recon; sid:200002385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-postfinance.com",nocase; classtype:attempted-recon; sid:200002386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-uniswap.com",nocase; classtype:attempted-recon; sid:200002387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-wa2022.duckdns.org",nocase; classtype:attempted-recon; sid:200002388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.privategold.uytrtyuhij987.gowithapex.com",nocase; classtype:attempted-recon; sid:200002389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.vdohnovenie.org.ua",nocase; classtype:attempted-recon; sid:200002390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login1006.wixsite.com",nocase; classtype:attempted-recon; sid:200002391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logindhlaccess.dhlupdatelogin.workers.dev",nocase; classtype:attempted-recon; sid:200002392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logverify-df12e-verify-1230-eu.web.app",nocase; classtype:attempted-recon; sid:200002393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lomadesarrollos.mx",nocase; classtype:attempted-recon; sid:200002394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lombard11.eu",nocase; classtype:attempted-recon; sid:200002395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"losingyourbelly.com",nocase; classtype:attempted-recon; sid:200002396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"losses.servemp3.com",nocase; classtype:attempted-recon; sid:200002397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lot-lp-x.web.app",nocase; classtype:attempted-recon; sid:200002398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lotterypunjab.in",nocase; classtype:attempted-recon; sid:200002399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lovefoodmore.com",nocase; classtype:attempted-recon; sid:200002400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lowkeyfresh.com",nocase; classtype:attempted-recon; sid:200002401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lqg8u8.webwave.dev",nocase; classtype:attempted-recon; sid:200002402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ltmhomes.org",nocase; classtype:attempted-recon; sid:200002403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ltxuypmm.com",nocase; classtype:attempted-recon; sid:200002404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucie-inter.myshopwired.com",nocase; classtype:attempted-recon; sid:200002405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucky-firefly-f7f9.pass-expiring-jeanatoday.workers.dev",nocase; classtype:attempted-recon; sid:200002406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucky-glitter-f89f.jimmysitt.workers.dev",nocase; classtype:attempted-recon; sid:200002407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luckylkhraylbwal.blogspot.com",nocase; classtype:attempted-recon; sid:200002408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucy-walker.com",nocase; classtype:attempted-recon; sid:200002409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ludiequip.es",nocase; classtype:attempted-recon; sid:200002410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lukslaikwimadid.ga",nocase; classtype:attempted-recon; sid:200002411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lumail61.wixsite.com",nocase; classtype:attempted-recon; sid:200002412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunugrcpujwcfnajuctkojawrh-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxuriousmagazineasia.com",nocase; classtype:attempted-recon; sid:200002414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m-facebook-com.facebook.suptr32.skyfencenet.com",nocase; classtype:attempted-recon; sid:200002415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.atualizacaosegura.app.br",nocase; classtype:attempted-recon; sid:200002416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.g2234.com",nocase; classtype:attempted-recon; sid:200002417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.g22m.com",nocase; classtype:attempted-recon; sid:200002418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.jt6287.com",nocase; classtype:attempted-recon; sid:200002419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.nca8922.com",nocase; classtype:attempted-recon; sid:200002420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.recovery.safetyacount.workers.dev",nocase; classtype:attempted-recon; sid:200002421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m1tb.ru",nocase; classtype:attempted-recon; sid:200002422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m42club.com",nocase; classtype:attempted-recon; sid:200002423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m54af8.webwave.dev",nocase; classtype:attempted-recon; sid:200002424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"machineryzoneservice.com",nocase; classtype:attempted-recon; sid:200002425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macjakarta.com",nocase; classtype:attempted-recon; sid:200002426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macro-sistemas.com",nocase; classtype:attempted-recon; sid:200002427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macst.cc",nocase; classtype:attempted-recon; sid:200002428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macstorejc.com",nocase; classtype:attempted-recon; sid:200002429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madens.com.pl",nocase; classtype:attempted-recon; sid:200002430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madrhinoconsulting.com",nocase; classtype:attempted-recon; sid:200002431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maestro.my.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200002432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magicteachescoresubjects.com",nocase; classtype:attempted-recon; sid:200002433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maharajams.github.io",nocase; classtype:attempted-recon; sid:200002434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maharjanpalpasa.com",nocase; classtype:attempted-recon; sid:200002435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mahikapur.in",nocase; classtype:attempted-recon; sid:200002436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-account-verify-f4723.web.app",nocase; classtype:attempted-recon; sid:200002437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-gmxaktualisierung.yolasite.com",nocase; classtype:attempted-recon; sid:200002438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-ovhcloud.web.app",nocase; classtype:attempted-recon; sid:200002439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-ssocloud-srvr67yhguh.pages.dev",nocase; classtype:attempted-recon; sid:200002440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.02-invalid-bundle.com",nocase; classtype:attempted-recon; sid:200002441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.attorneyandpractice.com",nocase; classtype:attempted-recon; sid:200002442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.auone-north.com",nocase; classtype:attempted-recon; sid:200002443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bay81studios.com",nocase; classtype:attempted-recon; sid:200002444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bemerrier.com",nocase; classtype:attempted-recon; sid:200002445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.dickielim.com",nocase; classtype:attempted-recon; sid:200002446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.easycoachltd.com",nocase; classtype:attempted-recon; sid:200002447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.enrollmoreclientsbootcamp.com",nocase; classtype:attempted-recon; sid:200002448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.grup-whatsapp-video-viral.duckdns.org",nocase; classtype:attempted-recon; sid:200002449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.harmonmedical.net",nocase; classtype:attempted-recon; sid:200002450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ims-fe.com",nocase; classtype:attempted-recon; sid:200002451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ivangomezofficial.com",nocase; classtype:attempted-recon; sid:200002452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.kuttabalfatih.com",nocase; classtype:attempted-recon; sid:200002453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mestedfung.digital",nocase; classtype:attempted-recon; sid:200002454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200002455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mybestwellbeing.com",nocase; classtype:attempted-recon; sid:200002456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nris.com.au",nocase; classtype:attempted-recon; sid:200002457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.phongvuexpress.vn",nocase; classtype:attempted-recon; sid:200002458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.santepluspharma.com",nocase; classtype:attempted-recon; sid:200002459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tariqalaraimi.com",nocase; classtype:attempted-recon; sid:200002460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.updateinfo-billingo2.com",nocase; classtype:attempted-recon; sid:200002461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.verify-online-mtbnking.duckdns.org",nocase; classtype:attempted-recon; sid:200002462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.wheel1factory.net",nocase; classtype:attempted-recon; sid:200002463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.zenstream.com",nocase; classtype:attempted-recon; sid:200002464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; classtype:attempted-recon; sid:200002465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail2.mclink.it",nocase; classtype:attempted-recon; sid:200002466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailbluewin.wixsite.com",nocase; classtype:attempted-recon; sid:200002467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailboxssddfd.creatorlink.net",nocase; classtype:attempted-recon; sid:200002468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailersrhdfdf.weebly.com",nocase; classtype:attempted-recon; sid:200002469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailgmx5aktualisieren.yolasite.com",nocase; classtype:attempted-recon; sid:200002470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailoginv1rd.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200002471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailplusrolerequestedprivatemailupdates.pages.dev",nocase; classtype:attempted-recon; sid:200002472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailserver7656566.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200002473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailsunriseinfo.wixsite.com",nocase; classtype:attempted-recon; sid:200002474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"main.d33zkliv4cpdl2.amplifyapp.com",nocase; classtype:attempted-recon; sid:200002475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mainehomeconnection.com",nocase; classtype:attempted-recon; sid:200002476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"majines.page.link",nocase; classtype:attempted-recon; sid:200002477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"make-anon-keep-past.rvsla.workers.dev",nocase; classtype:attempted-recon; sid:200002478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"makeup.servemp3.com",nocase; classtype:attempted-recon; sid:200002479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"makiniawardsprogramme.com",nocase; classtype:attempted-recon; sid:200002480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mala-riba.com",nocase; classtype:attempted-recon; sid:200002481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malamkelabu.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malamkelabu1.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malaprontaargentina.com.br",nocase; classtype:attempted-recon; sid:200002484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malukutenggarakab.go.id",nocase; classtype:attempted-recon; sid:200002485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mamabearcoffee.com",nocase; classtype:attempted-recon; sid:200002486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"man1bantul.sch.id",nocase; classtype:attempted-recon; sid:200002487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manateetreeservice.com",nocase; classtype:attempted-recon; sid:200002488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapsa.com.pe",nocase; classtype:attempted-recon; sid:200002489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marcar-ip.piloqrg.cn",nocase; classtype:attempted-recon; sid:200002490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marceluoribeiro.weebly.com",nocase; classtype:attempted-recon; sid:200002491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"margigitjari9987.co.vu",nocase; classtype:attempted-recon; sid:200002492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"margtons.com",nocase; classtype:attempted-recon; sid:200002493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marhisapkuat2231.co.vu",nocase; classtype:attempted-recon; sid:200002494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maria.susypro.com",nocase; classtype:attempted-recon; sid:200002495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marjirangustambayum.co.vu",nocase; classtype:attempted-recon; sid:200002496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"market.zapps.app",nocase; classtype:attempted-recon; sid:200002497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketing-group.ir",nocase; classtype:attempted-recon; sid:200002498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace.axieinflnity.cc",nocase; classtype:attempted-recon; sid:200002499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace.facebook.com-h3v9t9zycu.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace.facebook.com-zj07679bw4.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketvit.by",nocase; classtype:attempted-recon; sid:200002502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marmalamminggu.co.vu",nocase; classtype:attempted-recon; sid:200002503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marmalamsenin.co.vu",nocase; classtype:attempted-recon; sid:200002504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpagipening.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpagipening1.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpusingmalam.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpusingmalam1.co.vu",nocase; classtype:attempted-recon; sid:200002508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpusingmalam1.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marpusingmalam2.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martalunghabitats.co.vu",nocase; classtype:attempted-recon; sid:200002511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martanggukikan.co.vu",nocase; classtype:attempted-recon; sid:200002512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martanggukikan.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martimbangan324.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martulangkampung.co.vu",nocase; classtype:attempted-recon; sid:200002515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martumbang.co.vu",nocase; classtype:attempted-recon; sid:200002516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martumbang.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maspusabd.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"massaget5456hera.gb.net",nocase; classtype:attempted-recon; sid:200002519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masterdrive.com",nocase; classtype:attempted-recon; sid:200002520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masukgrub2021.duckdns.org",nocase; classtype:attempted-recon; sid:200002521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200002522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgirisimizgir.blogspot.com",nocase; classtype:attempted-recon; sid:200002523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"match.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200002524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matchoklahoma.com",nocase; classtype:attempted-recon; sid:200002525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mauivacationrentalreviews.com",nocase; classtype:attempted-recon; sid:200002526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxclinic.ru",nocase; classtype:attempted-recon; sid:200002527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxis-winner-2020.webs.com",nocase; classtype:attempted-recon; sid:200002528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mayormoveis.com",nocase; classtype:attempted-recon; sid:200002529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mbank-podpera.cz.swtest.ru",nocase; classtype:attempted-recon; sid:200002530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mbkj.wokeja2898.workers.dev",nocase; classtype:attempted-recon; sid:200002531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mboutique.cfd",nocase; classtype:attempted-recon; sid:200002532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mccarthyelectrical.com",nocase; classtype:attempted-recon; sid:200002533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mcconcep.cluster005.ovh.net",nocase; classtype:attempted-recon; sid:200002534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mchganistore.solofolio.net",nocase; classtype:attempted-recon; sid:200002535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mckennittfamily.com",nocase; classtype:attempted-recon; sid:200002536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mclaren-org.org",nocase; classtype:attempted-recon; sid:200002537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdex.li",nocase; classtype:attempted-recon; sid:200002538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdurucan.com",nocase; classtype:attempted-recon; sid:200002539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mechimahakali.net",nocase; classtype:attempted-recon; sid:200002540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mecrcari.com.pyhjsd.buzz",nocase; classtype:attempted-recon; sid:200002541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medelinahealth.com",nocase; classtype:attempted-recon; sid:200002542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medeniyetakademisi.org",nocase; classtype:attempted-recon; sid:200002543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mednungtanpoudan-acvwe3.ga",nocase; classtype:attempted-recon; sid:200002544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medo.world",nocase; classtype:attempted-recon; sid:200002545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medscore.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medtamr.com",nocase; classtype:attempted-recon; sid:200002547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meemessateledrama.com",nocase; classtype:attempted-recon; sid:200002548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meeting-23900123090123.bitbucket.io",nocase; classtype:attempted-recon; sid:200002549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mega.apk-guru.xyz",nocase; classtype:attempted-recon; sid:200002550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"megacredi.com",nocase; classtype:attempted-recon; sid:200002551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.fokea.info",nocase; classtype:attempted-recon; sid:200002552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.fomei.info",nocase; classtype:attempted-recon; sid:200002553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.fommt.info",nocase; classtype:attempted-recon; sid:200002554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.foneu.info",nocase; classtype:attempted-recon; sid:200002555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.foshe.info",nocase; classtype:attempted-recon; sid:200002556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.matok.info",nocase; classtype:attempted-recon; sid:200002557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.mlope.info",nocase; classtype:attempted-recon; sid:200002558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.poshe.info",nocase; classtype:attempted-recon; sid:200002559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.poslm.info",nocase; classtype:attempted-recon; sid:200002560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meicari.posmt.info",nocase; classtype:attempted-recon; sid:200002561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meinkonto-kontrol24.blogspot.com",nocase; classtype:attempted-recon; sid:200002562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"melodious-glib-clover.glitch.me",nocase; classtype:attempted-recon; sid:200002563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"melongroup.net",nocase; classtype:attempted-recon; sid:200002564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"members.theatrewomen.org",nocase; classtype:attempted-recon; sid:200002565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mer9c.info",nocase; classtype:attempted-recon; sid:200002566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meravl.co.il",nocase; classtype:attempted-recon; sid:200002567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercareo-5uyre.qexwallet.com",nocase; classtype:attempted-recon; sid:200002568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari-login.xyz",nocase; classtype:attempted-recon; sid:200002569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari-meicarijp.com",nocase; classtype:attempted-recon; sid:200002570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.co.jp.rodw6d9y.cn",nocase; classtype:attempted-recon; sid:200002571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.i4cz0hu.cn",nocase; classtype:attempted-recon; sid:200002572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.cmlml.com",nocase; classtype:attempted-recon; sid:200002573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.fgrgloi80ldjvl.mousad.com",nocase; classtype:attempted-recon; sid:200002574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.hduedu778gb.dogs.aotkbf.com",nocase; classtype:attempted-recon; sid:200002575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.jdfjgfdks.fudsj66dg.mrdfksa.com",nocase; classtype:attempted-recon; sid:200002576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.n27v8f92.cedmk.com",nocase; classtype:attempted-recon; sid:200002577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp.oudd.dog33nds.bfjssfd.com",nocase; classtype:attempted-recon; sid:200002578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp1.waymen.online",nocase; classtype:attempted-recon; sid:200002579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.jp2.waymen.online",nocase; classtype:attempted-recon; sid:200002580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merssc.com",nocase; classtype:attempted-recon; sid:200002581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.nhxnkl.cn",nocase; classtype:attempted-recon; sid:200002582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.x4f84i.cn",nocase; classtype:attempted-recon; sid:200002583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercariweb.jp.aetfxzd.xyz",nocase; classtype:attempted-recon; sid:200002584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercarli.shop",nocase; classtype:attempted-recon; sid:200002585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercatorgloves.com",nocase; classtype:attempted-recon; sid:200002586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercialsilfa.icu",nocase; classtype:attempted-recon; sid:200002587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercinfo.k6j2kt.cn",nocase; classtype:attempted-recon; sid:200002588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercnri.zxcui.info",nocase; classtype:attempted-recon; sid:200002589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercraii.xyz",nocase; classtype:attempted-recon; sid:200002590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meremanovegabana.website2.me",nocase; classtype:attempted-recon; sid:200002591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mergeurl.com",nocase; classtype:attempted-recon; sid:200002592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericari.maawm.com",nocase; classtype:attempted-recon; sid:200002593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericari.mhhhg.com",nocase; classtype:attempted-recon; sid:200002594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericari.mjjji.com",nocase; classtype:attempted-recon; sid:200002595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericarir.misspst.com",nocase; classtype:attempted-recon; sid:200002596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericarir.mmmah.com",nocase; classtype:attempted-recon; sid:200002597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericarir.mrmtw.com",nocase; classtype:attempted-recon; sid:200002598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerieassistancefixe.ctcin.bio",nocase; classtype:attempted-recon; sid:200002599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mester.info.hu",nocase; classtype:attempted-recon; sid:200002600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestercartoonplanetjed3.blogspot.com",nocase; classtype:attempted-recon; sid:200002601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertenchiuniversetue6.blogspot.com",nocase; classtype:attempted-recon; sid:200002602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet4.blogspot.com",nocase; classtype:attempted-recon; sid:200002603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet5.blogspot.com",nocase; classtype:attempted-recon; sid:200002604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet6.blogspot.com",nocase; classtype:attempted-recon; sid:200002605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestredaobra.com",nocase; classtype:attempted-recon; sid:200002606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meta-compliance.net",nocase; classtype:attempted-recon; sid:200002607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metabusinesscenterpages.co.vu",nocase; classtype:attempted-recon; sid:200002608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metallkom-spb.ru",nocase; classtype:attempted-recon; sid:200002609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metaltubos.com.br",nocase; classtype:attempted-recon; sid:200002610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metalurgicagiom.com.br",nocase; classtype:attempted-recon; sid:200002611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamasc.club",nocase; classtype:attempted-recon; sid:200002612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-extension.com.hsurge.com",nocase; classtype:attempted-recon; sid:200002613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-wallet.buzz",nocase; classtype:attempted-recon; sid:200002614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-wallet.cn",nocase; classtype:attempted-recon; sid:200002615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-wallets-protection.web.app",nocase; classtype:attempted-recon; sid:200002616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.ca",nocase; classtype:attempted-recon; sid:200002617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.cam",nocase; classtype:attempted-recon; sid:200002618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.io-lk.ru",nocase; classtype:attempted-recon; sid:200002619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.navy",nocase; classtype:attempted-recon; sid:200002620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.social",nocase; classtype:attempted-recon; sid:200002621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.wallet.recovery.s1.webspace.re",nocase; classtype:attempted-recon; sid:200002622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaskdownloadandroid.xyz",nocase; classtype:attempted-recon; sid:200002623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaskservicesweb.com",nocase; classtype:attempted-recon; sid:200002624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metemasks.info",nocase; classtype:attempted-recon; sid:200002625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meusabor.com.br",nocase; classtype:attempted-recon; sid:200002626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mf.rks-gov.net",nocase; classtype:attempted-recon; sid:200002627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.com.cy",nocase; classtype:attempted-recon; sid:200002628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.lt",nocase; classtype:attempted-recon; sid:200002629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.rs",nocase; classtype:attempted-recon; sid:200002630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.ru",nocase; classtype:attempted-recon; sid:200002631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhlw.club",nocase; classtype:attempted-recon; sid:200002632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miarzsil.click",nocase; classtype:attempted-recon; sid:200002633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mibancocrece.com.co",nocase; classtype:attempted-recon; sid:200002634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"michaelburdekin.com",nocase; classtype:attempted-recon; sid:200002635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microcav.square.site",nocase; classtype:attempted-recon; sid:200002636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft-dateserver.com",nocase; classtype:attempted-recon; sid:200002637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft-excel.kr.jaleco.com",nocase; classtype:attempted-recon; sid:200002638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft01829.odoo.com",nocase; classtype:attempted-recon; sid:200002639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftpassword009-updatepassword00-ja09square-term-484a.lllibby-webb6868.workers.dev",nocase; classtype:attempted-recon; sid:200002640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftwebserver.mfs.gg",nocase; classtype:attempted-recon; sid:200002641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"micuenta01.github.io",nocase; classtype:attempted-recon; sid:200002642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midshopping.ro",nocase; classtype:attempted-recon; sid:200002643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miecompany.8b.io",nocase; classtype:attempted-recon; sid:200002644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miforc-log.info",nocase; classtype:attempted-recon; sid:200002645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"migraformplus.com",nocase; classtype:attempted-recon; sid:200002646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"migrationic.ir",nocase; classtype:attempted-recon; sid:200002647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mijnbuitenhuis.nl",nocase; classtype:attempted-recon; sid:200002648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanobet301.com",nocase; classtype:attempted-recon; sid:200002649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"militarybikers.org",nocase; classtype:attempted-recon; sid:200002650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mimecast.fmlms.com",nocase; classtype:attempted-recon; sid:200002651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minamikaga.or.jp",nocase; classtype:attempted-recon; sid:200002652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mingming20160152.github.io",nocase; classtype:attempted-recon; sid:200002653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minllur.shop",nocase; classtype:attempted-recon; sid:200002654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miplab.net",nocase; classtype:attempted-recon; sid:200002655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miracdoviz.com",nocase; classtype:attempted-recon; sid:200002656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miss-paym02.com",nocase; classtype:attempted-recon; sid:200002657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missionshashank.org",nocase; classtype:attempted-recon; sid:200002658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixvmfjtkxutfgbdqgyvftdxaaiyygrkf.fast-page.org",nocase; classtype:attempted-recon; sid:200002659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxixmjeydgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxiymjnyza.filesusr.com",nocase; classtype:attempted-recon; sid:200002661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1heta1dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetezmtj0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetgym3jk.filesusr.com",nocase; classtype:attempted-recon; sid:200002664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetizmtl0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetqymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200002666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetu3dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetuymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200002668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu5vdmvtymvymji5dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu5vdmvtymvymtexdgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymufwcmlsmde5dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200002672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk1mtr0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhkzmtn0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmu0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmuymzfzda.filesusr.com",nocase; classtype:attempted-recon; sid:200002677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200002678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com",nocase; classtype:attempted-recon; sid:200002679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mk2.ge",nocase; classtype:attempted-recon; sid:200002680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mkiuyhakauywa.blogspot.com",nocase; classtype:attempted-recon; sid:200002681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mngantusik.co.vu",nocase; classtype:attempted-recon; sid:200002682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mngantusik.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200002683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mo-menthealth.com",nocase; classtype:attempted-recon; sid:200002684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobiile.systemredirect-pages.qf4owyef2n-xoy4w7wpr6pw.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobil-bireyselcepvakif.ml",nocase; classtype:attempted-recon; sid:200002686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-orange-forever.yolasite.com",nocase; classtype:attempted-recon; sid:200002687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-portail.live",nocase; classtype:attempted-recon; sid:200002688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.app-pages-recovery00423222997477501510.jbud4ix21f-zqy3jw70y6kg.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.app-pages-recovery32229164263838535823.jbud4ix21f-zqy3jw70y6kg.p.runcloud.link",nocase; classtype:attempted-recon; sid:200002690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.de.user.inserat4453.de",nocase; classtype:attempted-recon; sid:200002691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobileappsanpoloaggiornamenttosicuramoble.dubya.net",nocase; classtype:attempted-recon; sid:200002692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobiledesbloqueio.com",nocase; classtype:attempted-recon; sid:200002693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mockup.metradigitalmedia.com",nocase; classtype:attempted-recon; sid:200002694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moderka-sklep.pl",nocase; classtype:attempted-recon; sid:200002695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mohammad.tech",nocase; classtype:attempted-recon; sid:200002696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moinol-space.preview-domain.com",nocase; classtype:attempted-recon; sid:200002697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mon-token.com",nocase; classtype:attempted-recon; sid:200002698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monbudri.xyz",nocase; classtype:attempted-recon; sid:200002699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mondrive.xyz",nocase; classtype:attempted-recon; sid:200002700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monedri.xyz",nocase; classtype:attempted-recon; sid:200002701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monetiza.online-formacionveterinaria.com",nocase; classtype:attempted-recon; sid:200002702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moni.bg",nocase; classtype:attempted-recon; sid:200002703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monirshouvo.github.io",nocase; classtype:attempted-recon; sid:200002704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monomobileservice.yolasite.com",nocase; classtype:attempted-recon; sid:200002705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monprofilclient.web.app",nocase; classtype:attempted-recon; sid:200002706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monstercarp.rn86.ru",nocase; classtype:attempted-recon; sid:200002707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montagnani.it",nocase; classtype:attempted-recon; sid:200002708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monteithsolutionslimited.com",nocase; classtype:attempted-recon; sid:200002709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montenegrolandscape.com",nocase; classtype:attempted-recon; sid:200002710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montmabesa1888.blogspot.com",nocase; classtype:attempted-recon; sid:200002711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montrealidiomas.com.br",nocase; classtype:attempted-recon; sid:200002712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monyeward.com",nocase; classtype:attempted-recon; sid:200002713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monzo-review-account.com",nocase; classtype:attempted-recon; sid:200002714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moretimeforyou.com",nocase; classtype:attempted-recon; sid:200002715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morning-cloud-9b80.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200002716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morning-tree-7f87.valid-secr.workers.dev",nocase; classtype:attempted-recon; sid:200002717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mosvisa24.ru",nocase; classtype:attempted-recon; sid:200002718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motamask.net",nocase; classtype:attempted-recon; sid:200002719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motorboatracing-association.jp",nocase; classtype:attempted-recon; sid:200002720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mountainghostknife.club",nocase; classtype:attempted-recon; sid:200002721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"movingriderstravel.com",nocase; classtype:attempted-recon; sid:200002722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mpaypal.cf",nocase; classtype:attempted-recon; sid:200002723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mq.gl",nocase; classtype:attempted-recon; sid:200002724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mqu90adytn7.typeform.com",nocase; classtype:attempted-recon; sid:200002725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mrvlocacao.com.br",nocase; classtype:attempted-recon; sid:200002726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msc-doelsach.at",nocase; classtype:attempted-recon; sid:200002727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msmetdcagra.in",nocase; classtype:attempted-recon; sid:200002728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msnserviceverifivation.wordpress.com",nocase; classtype:attempted-recon; sid:200002729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msoffice.online.authenticationgateway.com",nocase; classtype:attempted-recon; sid:200002730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msofficemessagescenter-1.mfs.gg",nocase; classtype:attempted-recon; sid:200002731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mst.pe",nocase; classtype:attempted-recon; sid:200002732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtbanko3.dd-dns.de",nocase; classtype:attempted-recon; sid:200002733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtbmtbmtb2.sfo3.digitaloceanspaces.com",nocase; classtype:attempted-recon; sid:200002734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtngifts2021.blogspot.com",nocase; classtype:attempted-recon; sid:200002735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtpo.pages.dev",nocase; classtype:attempted-recon; sid:200002736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtron.in",nocase; classtype:attempted-recon; sid:200002737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtsn1kotabekasi.sch.id",nocase; classtype:attempted-recon; sid:200002738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muban002.xnli.cn",nocase; classtype:attempted-recon; sid:200002739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muddy-credit-ea7b.0fflce-mlcr0sfot-online-supposrts3jp-tokcloud.workers.dev",nocase; classtype:attempted-recon; sid:200002740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mudraloans.biz",nocase; classtype:attempted-recon; sid:200002741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muestrame.cl",nocase; classtype:attempted-recon; sid:200002742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mulenaikokjs.com",nocase; classtype:attempted-recon; sid:200002743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muleshoe-eng.com",nocase; classtype:attempted-recon; sid:200002744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"municieneguillagobpe.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200002746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicisit.de",nocase; classtype:attempted-recon; sid:200002747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mvconstraser.com",nocase; classtype:attempted-recon; sid:200002748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mvxb0rb.cn",nocase; classtype:attempted-recon; sid:200002749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mwclearancesale.shop",nocase; classtype:attempted-recon; sid:200002750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mxrr.com",nocase; classtype:attempted-recon; sid:200002751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-bithumb.web.app",nocase; classtype:attempted-recon; sid:200002752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-gmail.ir",nocase; classtype:attempted-recon; sid:200002753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-site219.yolasite.com",nocase; classtype:attempted-recon; sid:200002754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.nativeforms.com",nocase; classtype:attempted-recon; sid:200002755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.paidy.login1.xcz0uf.cn",nocase; classtype:attempted-recon; sid:200002756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my02billing-login.com",nocase; classtype:attempted-recon; sid:200002757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myappweb-td.com",nocase; classtype:attempted-recon; sid:200002758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybank.toc.com.ec",nocase; classtype:attempted-recon; sid:200002759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mycoerver.es",nocase; classtype:attempted-recon; sid:200002760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myethrewellet.com",nocase; classtype:attempted-recon; sid:200002761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mygoogleaccount.stantrade.xyz",nocase; classtype:attempted-recon; sid:200002762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myguru.us",nocase; classtype:attempted-recon; sid:200002763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb.pqzme.cn",nocase; classtype:attempted-recon; sid:200002764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb.rrolicy.cn",nocase; classtype:attempted-recon; sid:200002765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb.wlzxzd.cn",nocase; classtype:attempted-recon; sid:200002766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb.xjpzvvl.cn",nocase; classtype:attempted-recon; sid:200002767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mykonos.cl",nocase; classtype:attempted-recon; sid:200002768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mylovejar.com",nocase; classtype:attempted-recon; sid:200002769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymonero.ru",nocase; classtype:attempted-recon; sid:200002770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymweb-owner.at.ua",nocase; classtype:attempted-recon; sid:200002771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-billing-error28.com",nocase; classtype:attempted-recon; sid:200002772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myperiodhealth.com",nocase; classtype:attempted-recon; sid:200002773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myqli.com",nocase; classtype:attempted-recon; sid:200002774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myrg.bullionbank.life",nocase; classtype:attempted-recon; sid:200002775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myshedbuilder.com",nocase; classtype:attempted-recon; sid:200002776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysites.infinityfreeapp.com",nocase; classtype:attempted-recon; sid:200002777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysterybay.com.au",nocase; classtype:attempted-recon; sid:200002778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mytheamsauthecent.wapgem.com",nocase; classtype:attempted-recon; sid:200002779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myupdates-mynetflix.com",nocase; classtype:attempted-recon; sid:200002780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myvodafone-co-uk.user-id0021.com",nocase; classtype:attempted-recon; sid:200002781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mywalletbrowser.com",nocase; classtype:attempted-recon; sid:200002782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n-naoko-0319.github.io",nocase; classtype:attempted-recon; sid:200002783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n-usps.com",nocase; classtype:attempted-recon; sid:200002784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.acesstnn.com",nocase; classtype:attempted-recon; sid:200002785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200002786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.aoeaomsnexc.com",nocase; classtype:attempted-recon; sid:200002787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200002788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.casscard.com",nocase; classtype:attempted-recon; sid:200002789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.coesacd.com",nocase; classtype:attempted-recon; sid:200002790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.csecoed.com",nocase; classtype:attempted-recon; sid:200002791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.mcsemrini.com",nocase; classtype:attempted-recon; sid:200002792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n.measeriiei.com",nocase; classtype:attempted-recon; sid:200002793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n2m5kc.cn",nocase; classtype:attempted-recon; sid:200002794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n7orton.com",nocase; classtype:attempted-recon; sid:200002795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab-alert.mobi",nocase; classtype:attempted-recon; sid:200002796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab-www.303.si",nocase; classtype:attempted-recon; sid:200002797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nab.maptq.com",nocase; classtype:attempted-recon; sid:200002798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.com",nocase; classtype:attempted-recon; sid:200002799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.kr",nocase; classtype:attempted-recon; sid:200002800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nacionestsegu.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"najboljeuslugezavas.betterservicesforyou.com",nocase; classtype:attempted-recon; sid:200002802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"napgamelienquan.net",nocase; classtype:attempted-recon; sid:200002803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"napscratch.com",nocase; classtype:attempted-recon; sid:200002804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"naranja-users.auth0.com",nocase; classtype:attempted-recon; sid:200002805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narrativesummit.org",nocase; classtype:attempted-recon; sid:200002806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.nwolb-login-auth.com",nocase; classtype:attempted-recon; sid:200002807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secure-auth-personal-device.com",nocase; classtype:attempted-recon; sid:200002808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-online-verify.com",nocase; classtype:attempted-recon; sid:200002809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-personal-verify.com",nocase; classtype:attempted-recon; sid:200002810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"naughty-murdock-07a672.netlify.app",nocase; classtype:attempted-recon; sid:200002811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"navigatorthailand.com",nocase; classtype:attempted-recon; sid:200002812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nayameehomes.com",nocase; classtype:attempted-recon; sid:200002813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncrba.webcindario.com",nocase; classtype:attempted-recon; sid:200002814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncservices.co.in",nocase; classtype:attempted-recon; sid:200002815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nebarmob.com",nocase; classtype:attempted-recon; sid:200002816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"necessitymag.com",nocase; classtype:attempted-recon; sid:200002817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbank.demdex.net",nocase; classtype:attempted-recon; sid:200002818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbankqa.flowblocks.com",nocase; classtype:attempted-recon; sid:200002819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedirien.online",nocase; classtype:attempted-recon; sid:200002820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"negerti-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200002821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"negociebra.com.br",nocase; classtype:attempted-recon; sid:200002822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"negocios-e-financas.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nelsonjustus.com.br",nocase; classtype:attempted-recon; sid:200002824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neltfxix.blogspot.com",nocase; classtype:attempted-recon; sid:200002825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neptuneinnovations.com",nocase; classtype:attempted-recon; sid:200002826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netciti.id",nocase; classtype:attempted-recon; sid:200002827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netfliwsup.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200002828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-com.com",nocase; classtype:attempted-recon; sid:200002829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-fr-fr-navlink-connexion.trans-mea.com",nocase; classtype:attempted-recon; sid:200002830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-techarmy.me",nocase; classtype:attempted-recon; sid:200002831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netgate-store.com",nocase; classtype:attempted-recon; sid:200002832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"network.innovatedm.com",nocase; classtype:attempted-recon; sid:200002833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neuromaster.com.br",nocase; classtype:attempted-recon; sid:200002834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neversencommun.fr",nocase; classtype:attempted-recon; sid:200002835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newcastlepatiocoversandpergolas.com.au",nocase; classtype:attempted-recon; sid:200002836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newrydramafestival.co.uk",nocase; classtype:attempted-recon; sid:200002837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsletter.pagueonlinebra.com.br",nocase; classtype:attempted-recon; sid:200002838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newupdateppl.blogspot.com",nocase; classtype:attempted-recon; sid:200002839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newyorkslice.pk",nocase; classtype:attempted-recon; sid:200002840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nextgensoftbd.com",nocase; classtype:attempted-recon; sid:200002841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhattinsteel.com",nocase; classtype:attempted-recon; sid:200002842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhfactor.com",nocase; classtype:attempted-recon; sid:200002843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhri.net",nocase; classtype:attempted-recon; sid:200002844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"niagarapower.com",nocase; classtype:attempted-recon; sid:200002845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihongospeechtrainer.com",nocase; classtype:attempted-recon; sid:200002846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nikomac.main.jp",nocase; classtype:attempted-recon; sid:200002847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nineled.com",nocase; classtype:attempted-recon; sid:200002848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nizotchauffage.bilty.be",nocase; classtype:attempted-recon; sid:200002849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"njxzhf.ml",nocase; classtype:attempted-recon; sid:200002850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nnby.azwv.com.cn",nocase; classtype:attempted-recon; sid:200002851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"no.bank-id.cc",nocase; classtype:attempted-recon; sid:200002852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noisy-glitter-1827.workupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200002853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nombud.xyz",nocase; classtype:attempted-recon; sid:200002854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nop.bbi.mybluehost.me",nocase; classtype:attempted-recon; sid:200002855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"northshore-pool.com",nocase; classtype:attempted-recon; sid:200002856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nostrils.servehttp.com",nocase; classtype:attempted-recon; sid:200002857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notendur.hi.is",nocase; classtype:attempted-recon; sid:200002858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notesfromnorthwest.pl",nocase; classtype:attempted-recon; sid:200002859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noticia.link",nocase; classtype:attempted-recon; sid:200002860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noticspage-identityrecovery.ga",nocase; classtype:attempted-recon; sid:200002861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notife.help.institutepages.workers.dev",nocase; classtype:attempted-recon; sid:200002862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-fb.secure-pages.workers.dev",nocase; classtype:attempted-recon; sid:200002863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificationmember.mystrikingly.com",nocase; classtype:attempted-recon; sid:200002864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nour-ala-nour.com",nocase; classtype:attempted-recon; sid:200002865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nova.stavcsm.ru",nocase; classtype:attempted-recon; sid:200002866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nozed-uname.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nrf401k.com",nocase; classtype:attempted-recon; sid:200002868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nsaclaim.com",nocase; classtype:attempted-recon; sid:200002869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nserviceserviceat.mystrikingly.com",nocase; classtype:attempted-recon; sid:200002870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nslg8.codesandbox.io",nocase; classtype:attempted-recon; sid:200002871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nt.embluemail.com",nocase; classtype:attempted-recon; sid:200002872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nueva-acropolis.cl",nocase; classtype:attempted-recon; sid:200002873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"numero0608.interculturalidad.org",nocase; classtype:attempted-recon; sid:200002874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nunaproducciones.com",nocase; classtype:attempted-recon; sid:200002875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuovesicurezzeonline.com",nocase; classtype:attempted-recon; sid:200002876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nutralashserum.com",nocase; classtype:attempted-recon; sid:200002877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nutritiouskibble.com",nocase; classtype:attempted-recon; sid:200002878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nutroquin.com",nocase; classtype:attempted-recon; sid:200002879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nw-securedfailure.com",nocase; classtype:attempted-recon; sid:200002880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ny989.com",nocase; classtype:attempted-recon; sid:200002881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyhet.cc",nocase; classtype:attempted-recon; sid:200002882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nzpi.com",nocase; classtype:attempted-recon; sid:200002883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200002884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.aoeaomsnexc.com",nocase; classtype:attempted-recon; sid:200002885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.aoemsiecsan.com",nocase; classtype:attempted-recon; sid:200002886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.aoeosten.com",nocase; classtype:attempted-recon; sid:200002887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200002888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.casscard.com",nocase; classtype:attempted-recon; sid:200002889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.coesacd.com",nocase; classtype:attempted-recon; sid:200002890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.csecoed.com",nocase; classtype:attempted-recon; sid:200002891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.mceosrei.com",nocase; classtype:attempted-recon; sid:200002892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.mcsemrini.com",nocase; classtype:attempted-recon; sid:200002893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o.measeriiei.com",nocase; classtype:attempted-recon; sid:200002894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-failure-billing-update.com",nocase; classtype:attempted-recon; sid:200002895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-unpaid-fees.com",nocase; classtype:attempted-recon; sid:200002896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-updatebillingvia.com",nocase; classtype:attempted-recon; sid:200002897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2billingauth-update.com",nocase; classtype:attempted-recon; sid:200002898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oaps0cc.cn",nocase; classtype:attempted-recon; sid:200002899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objective-merkle.45-88-108-231.plesk.page",nocase; classtype:attempted-recon; sid:200002900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"obmobile.tmweb.ru",nocase; classtype:attempted-recon; sid:200002901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ocaque-domen.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oceantires.com",nocase; classtype:attempted-recon; sid:200002903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ocioturismogalicia.com",nocase; classtype:attempted-recon; sid:200002904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"odiasamaj.net",nocase; classtype:attempted-recon; sid:200002905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"odpasswordupdate-outlook365-microsoftpasswor0mpatient-pond-1e5c.pedrogonzalezmxamrocom.workers.dev",nocase; classtype:attempted-recon; sid:200002906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oferta-16.lin81k.cc",nocase; classtype:attempted-recon; sid:200002907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic365.online",nocase; classtype:attempted-recon; sid:200002908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic3887688.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200002909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic4046217.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200002910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office-online.mb85d90t8p855.workers.dev",nocase; classtype:attempted-recon; sid:200002911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office.community-foundation.work",nocase; classtype:attempted-recon; sid:200002912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officeee.bubbleapps.io",nocase; classtype:attempted-recon; sid:200002913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialevent.way.live",nocase; classtype:attempted-recon; sid:200002914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialliker.co",nocase; classtype:attempted-recon; sid:200002915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialy2k.com",nocase; classtype:attempted-recon; sid:200002916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ofmvp.com",nocase; classtype:attempted-recon; sid:200002917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ogrodywlochy.pl",nocase; classtype:attempted-recon; sid:200002918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ogz6d.codesandbox.io",nocase; classtype:attempted-recon; sid:200002919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oi58904x.yolasite.com",nocase; classtype:attempted-recon; sid:200002920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oij.20rkmxt5955579.workers.dev",nocase; classtype:attempted-recon; sid:200002921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oimos.com.mx",nocase; classtype:attempted-recon; sid:200002922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oisnui.com",nocase; classtype:attempted-recon; sid:200002923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojh7ac.cn",nocase; classtype:attempted-recon; sid:200002924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojnw.app.link",nocase; classtype:attempted-recon; sid:200002925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojs.budimulia.ac.id",nocase; classtype:attempted-recon; sid:200002926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okwok.co.kr",nocase; classtype:attempted-recon; sid:200002927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old-grass-c912.dhldeliverylogintoconfirm.workers.dev",nocase; classtype:attempted-recon; sid:200002928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old.jkl.be",nocase; classtype:attempted-recon; sid:200002929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old.prunescape.com.au",nocase; classtype:attempted-recon; sid:200002930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldschoolrs-page.com",nocase; classtype:attempted-recon; sid:200002931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldshi.com.tw",nocase; classtype:attempted-recon; sid:200002932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olidooo.waca.tw",nocase; classtype:attempted-recon; sid:200002933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-group.com",nocase; classtype:attempted-recon; sid:200002934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.53662.space",nocase; classtype:attempted-recon; sid:200002935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-ro.id-53.xyz",nocase; classtype:attempted-recon; sid:200002936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-service.pl",nocase; classtype:attempted-recon; sid:200002937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-id741566512.net",nocase; classtype:attempted-recon; sid:200002938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omesqiwines.de",nocase; classtype:attempted-recon; sid:200002939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onamae.gmovps.com",nocase; classtype:attempted-recon; sid:200002940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oncopharma-ae.com",nocase; classtype:attempted-recon; sid:200002941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onecreator.info",nocase; classtype:attempted-recon; sid:200002942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.zhaoge.workers.dev",nocase; classtype:attempted-recon; sid:200002943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onee-a0488.web.app",nocase; classtype:attempted-recon; sid:200002944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-19cd8.web.app",nocase; classtype:attempted-recon; sid:200002945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-a38ef.web.app",nocase; classtype:attempted-recon; sid:200002946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ongocasavus.creatorlink.net",nocase; classtype:attempted-recon; sid:200002947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlibanks.5k5.ru",nocase; classtype:attempted-recon; sid:200002948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.auone.jp-signin.kddi-mobile549.com",nocase; classtype:attempted-recon; sid:200002949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineduplicatebills.com",nocase; classtype:attempted-recon; sid:200002950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinesbi.online",nocase; classtype:attempted-recon; sid:200002951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineverifi.com",nocase; classtype:attempted-recon; sid:200002952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlyprimitivetribe.com",nocase; classtype:attempted-recon; sid:200002953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlysportplus.com",nocase; classtype:attempted-recon; sid:200002954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onoiuza.aiouna.xyz",nocase; classtype:attempted-recon; sid:200002955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ooxvocalor.yolasite.com",nocase; classtype:attempted-recon; sid:200002956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opansea.live",nocase; classtype:attempted-recon; sid:200002957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"open24.ie-tsb.email",nocase; classtype:attempted-recon; sid:200002958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"operacaocaixa.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200002959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opfgmdm.creatorlink.net",nocase; classtype:attempted-recon; sid:200002960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opjkk.creatorlink.net",nocase; classtype:attempted-recon; sid:200002961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opticabattilana.com.ar",nocase; classtype:attempted-recon; sid:200002962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optika-anda.hr",nocase; classtype:attempted-recon; sid:200002963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-au.blogspot.com",nocase; classtype:attempted-recon; sid:200002964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-com-au.blogspot.com",nocase; classtype:attempted-recon; sid:200002965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; classtype:attempted-recon; sid:200002966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ora-n.yolasite.com",nocase; classtype:attempted-recon; sid:200002967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orabu.it",nocase; classtype:attempted-recon; sid:200002968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-dcr.fr",nocase; classtype:attempted-recon; sid:200002969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-hill-74ca.avopacific.workers.dev",nocase; classtype:attempted-recon; sid:200002970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-mobile16.wixsite.com",nocase; classtype:attempted-recon; sid:200002971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-security.cloud.coreoz.com",nocase; classtype:attempted-recon; sid:200002972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange.iobeya.com",nocase; classtype:attempted-recon; sid:200002973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange.sphinxonline.net",nocase; classtype:attempted-recon; sid:200002974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemessagerie4.wixsite.com",nocase; classtype:attempted-recon; sid:200002975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangess.contactin.bio",nocase; classtype:attempted-recon; sid:200002976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orcapm.com",nocase; classtype:attempted-recon; sid:200002977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ordersense.pk",nocase; classtype:attempted-recon; sid:200002978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"org-nr.yolasite.com",nocase; classtype:attempted-recon; sid:200002979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalcomics.fr",nocase; classtype:attempted-recon; sid:200002980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalfilm.se",nocase; classtype:attempted-recon; sid:200002981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen-corporation.us",nocase; classtype:attempted-recon; sid:200002982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen.digital",nocase; classtype:attempted-recon; sid:200002983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlencorporation.us",nocase; classtype:attempted-recon; sid:200002984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlenoil-la.com",nocase; classtype:attempted-recon; sid:200002985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ormantencs112.odoo.com",nocase; classtype:attempted-recon; sid:200002986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"osmaslo.ru",nocase; classtype:attempted-recon; sid:200002987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"osoujimaster.com",nocase; classtype:attempted-recon; sid:200002988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ot-wooden-nickel-tool.azurewebsites.net",nocase; classtype:attempted-recon; sid:200002989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto-h229.net",nocase; classtype:attempted-recon; sid:200002990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto3452.com",nocase; classtype:attempted-recon; sid:200002991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oudczfbniitcqdsrmaapdztwqo-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourgarden.us",nocase; classtype:attempted-recon; sid:200002993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourietirec.info",nocase; classtype:attempted-recon; sid:200002994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourlovmess.wordpress.com",nocase; classtype:attempted-recon; sid:200002995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlineacds.com",nocase; classtype:attempted-recon; sid:200002996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-mailer.com",nocase; classtype:attempted-recon; sid:200002997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-microsoftlogin98uqwuuw8as.questionpro.com",nocase; classtype:attempted-recon; sid:200002998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook1541489.webcindario.com",nocase; classtype:attempted-recon; sid:200002999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookcom119.yolasite.com",nocase; classtype:attempted-recon; sid:200003000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outrageous-topaz-payment.glitch.me",nocase; classtype:attempted-recon; sid:200003001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ov74x.codesandbox.io",nocase; classtype:attempted-recon; sid:200003002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"overitbalicek.flywheelsites.com",nocase; classtype:attempted-recon; sid:200003003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owaauthmail.sitey.me",nocase; classtype:attempted-recon; sid:200003004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ozxl0q.webwave.dev",nocase; classtype:attempted-recon; sid:200003006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p.cbhhomes.com",nocase; classtype:attempted-recon; sid:200003007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p.wpage.cc",nocase; classtype:attempted-recon; sid:200003008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1.pagewiz.net",nocase; classtype:attempted-recon; sid:200003009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1c.servleboncoinser.com",nocase; classtype:attempted-recon; sid:200003010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p402s.codesandbox.io",nocase; classtype:attempted-recon; sid:200003011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paancaakeeswaap.financial",nocase; classtype:attempted-recon; sid:200003012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paancaakeeswap.financial",nocase; classtype:attempted-recon; sid:200003013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paancaakswaap.digital",nocase; classtype:attempted-recon; sid:200003014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paapelleeireiras.com",nocase; classtype:attempted-recon; sid:200003015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paavos.in",nocase; classtype:attempted-recon; sid:200003016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"packaage.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200003017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"package2021.blogspot.ba",nocase; classtype:attempted-recon; sid:200003018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"package2021.blogspot.bg",nocase; classtype:attempted-recon; sid:200003019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"package2021.blogspot.com",nocase; classtype:attempted-recon; sid:200003020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageactivityviolatescopyrightreport.co.vu",nocase; classtype:attempted-recon; sid:200003021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageconfirmationsecurity.co.vu",nocase; classtype:attempted-recon; sid:200003022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagedemo.co",nocase; classtype:attempted-recon; sid:200003023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagehelpssupportidentityasmuchaspossible.co.vu",nocase; classtype:attempted-recon; sid:200003024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagereconfirmaccounts.co.vu",nocase; classtype:attempted-recon; sid:200003025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-help-account-center-2021.ga",nocase; classtype:attempted-recon; sid:200003026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-marvelous-project.webflow.io",nocase; classtype:attempted-recon; sid:200003027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages.secure-accts.workers.dev",nocase; classtype:attempted-recon; sid:200003028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesconfirmationnotifybusiness.co.vu",nocase; classtype:attempted-recon; sid:200003029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageshelpbussinessidentityservice.co.vu",nocase; classtype:attempted-recon; sid:200003030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesidentityconfirmationkebokrp.co.vu",nocase; classtype:attempted-recon; sid:200003031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesverificationidentitysecuritybusinesshelpcenter.co.vu",nocase; classtype:attempted-recon; sid:200003032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageupdate-protection.tk",nocase; classtype:attempted-recon; sid:200003033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageupdates-protections.gq",nocase; classtype:attempted-recon; sid:200003034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageviolationdetectedsactivityposted.co.vu",nocase; classtype:attempted-recon; sid:200003035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagos.sinpemovil.cr",nocase; classtype:attempted-recon; sid:200003036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paiement-0range-fr-3749b65b.scrivani.pt",nocase; classtype:attempted-recon; sid:200003037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"palmm.ps",nocase; classtype:attempted-recon; sid:200003038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panahotcosegu.webcindario.com",nocase; classtype:attempted-recon; sid:200003039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancaakeeswap.financial",nocase; classtype:attempted-recon; sid:200003040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancaakesvap.com",nocase; classtype:attempted-recon; sid:200003041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake-sawp.com",nocase; classtype:attempted-recon; sid:200003042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake.asia",nocase; classtype:attempted-recon; sid:200003043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake.finance.fixswaps.com",nocase; classtype:attempted-recon; sid:200003044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake.holdings",nocase; classtype:attempted-recon; sid:200003045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake.wales",nocase; classtype:attempted-recon; sid:200003046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake7wop.com",nocase; classtype:attempted-recon; sid:200003047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesawp-app.com",nocase; classtype:attempted-recon; sid:200003048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesfinances.info",nocase; classtype:attempted-recon; sid:200003049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesswapfinance.net",nocase; classtype:attempted-recon; sid:200003050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvvap-finance.net",nocase; classtype:attempted-recon; sid:200003051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvvap-finance.org",nocase; classtype:attempted-recon; sid:200003052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvvapp.finance",nocase; classtype:attempted-recon; sid:200003053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesvwape.finance",nocase; classtype:attempted-recon; sid:200003054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesw-ap.com",nocase; classtype:attempted-recon; sid:200003055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-finance.store",nocase; classtype:attempted-recon; sid:200003056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-finence.com",nocase; classtype:attempted-recon; sid:200003057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap-page.com",nocase; classtype:attempted-recon; sid:200003058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.co.com",nocase; classtype:attempted-recon; sid:200003059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance.litycoo.tk",nocase; classtype:attempted-recon; sid:200003060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.ist",nocase; classtype:attempted-recon; sid:200003061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.men",nocase; classtype:attempted-recon; sid:200003062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.salsasourcing.com",nocase; classtype:attempted-recon; sid:200003063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.tv",nocase; classtype:attempted-recon; sid:200003064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapdrive.com",nocase; classtype:attempted-recon; sid:200003065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswappshop.blogspot.com",nocase; classtype:attempted-recon; sid:200003066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaps.info",nocase; classtype:attempted-recon; sid:200003067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapvv.com",nocase; classtype:attempted-recon; sid:200003068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapww.com",nocase; classtype:attempted-recon; sid:200003069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswitch.com",nocase; classtype:attempted-recon; sid:200003070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakewe.com",nocase; classtype:attempted-recon; sid:200003071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakewswap.com",nocase; classtype:attempted-recon; sid:200003072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakswap.at",nocase; classtype:attempted-recon; sid:200003073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancalteswap.finance",nocase; classtype:attempted-recon; sid:200003074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panckaceswap.finance",nocase; classtype:attempted-recon; sid:200003075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancuckeswop.com",nocase; classtype:attempted-recon; sid:200003076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancwackswan.com",nocase; classtype:attempted-recon; sid:200003077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancwakeswan.com",nocase; classtype:attempted-recon; sid:200003078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pandaskin.ru.com",nocase; classtype:attempted-recon; sid:200003079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panelweb-4cae2.web.app",nocase; classtype:attempted-recon; sid:200003080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pankakeswap.ledgity.com",nocase; classtype:attempted-recon; sid:200003081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panscakeswapes.finance",nocase; classtype:attempted-recon; sid:200003082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panterpro.com",nocase; classtype:attempted-recon; sid:200003083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paralafiesta.mx",nocase; classtype:attempted-recon; sid:200003084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pardot.assemblecommunities.com",nocase; classtype:attempted-recon; sid:200003085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parkfans.nl",nocase; classtype:attempted-recon; sid:200003086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"partner-prize.com",nocase; classtype:attempted-recon; sid:200003087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pasarbta.info",nocase; classtype:attempted-recon; sid:200003088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"passionfruit4576261.brizy.site",nocase; classtype:attempted-recon; sid:200003089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"password-veri.shar3docskw7.cloudns.ph",nocase; classtype:attempted-recon; sid:200003090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pateltutorials.com",nocase; classtype:attempted-recon; sid:200003091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"path.faithbible.institute",nocase; classtype:attempted-recon; sid:200003092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pathikareps.com",nocase; classtype:attempted-recon; sid:200003093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pathospitals.com",nocase; classtype:attempted-recon; sid:200003094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pathotels.in",nocase; classtype:attempted-recon; sid:200003095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patient-cell-40f5.updatedlogmylogin.workers.dev",nocase; classtype:attempted-recon; sid:200003096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pavillon8-14.ch",nocase; classtype:attempted-recon; sid:200003097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful-menu.com.auraco.ca",nocase; classtype:attempted-recon; sid:200003098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful.com.pk",nocase; classtype:attempted-recon; sid:200003099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful.com.pl",nocase; classtype:attempted-recon; sid:200003100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxfulmining.com",nocase; classtype:attempted-recon; sid:200003101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxfuls.xyz",nocase; classtype:attempted-recon; sid:200003102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay-sera.web.app",nocase; classtype:attempted-recon; sid:200003103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay16-olx.pl",nocase; classtype:attempted-recon; sid:200003104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paylah-dbs.herokuapp.com",nocase; classtype:attempted-recon; sid:200003105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment-reverse07-tsb-uk.wishneff.com",nocase; classtype:attempted-recon; sid:200003106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment.irs.benefit.marypoesia.com",nocase; classtype:attempted-recon; sid:200003107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentfailure-assistant.com",nocase; classtype:attempted-recon; sid:200003108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentnotificationnow.blogspot.com",nocase; classtype:attempted-recon; sid:200003109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-customer-service.business.site",nocase; classtype:attempted-recon; sid:200003110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-online-2deposits-paymentaccept.tk",nocase; classtype:attempted-recon; sid:200003111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-opladen.be",nocase; classtype:attempted-recon; sid:200003112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-secured-verification.lhr.rocks",nocase; classtype:attempted-recon; sid:200003113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-securi.com",nocase; classtype:attempted-recon; sid:200003114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se",nocase; classtype:attempted-recon; sid:200003115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.update.service.verify.freeget.net",nocase; classtype:attempted-recon; sid:200003116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalforex.co.ke",nocase; classtype:attempted-recon; sid:200003117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalproofgenerator.glitch.me",nocase; classtype:attempted-recon; sid:200003118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypaymi.com",nocase; classtype:attempted-recon; sid:200003119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypayone.com",nocase; classtype:attempted-recon; sid:200003120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pchnchabanc.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200003122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-cloud-document.weeblysite.com",nocase; classtype:attempted-recon; sid:200003123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-sharefile-doc.weeblysite.com",nocase; classtype:attempted-recon; sid:200003124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf.auth.01files-downloads.xyz",nocase; classtype:attempted-recon; sid:200003125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdflogincnvwo.app.link",nocase; classtype:attempted-recon; sid:200003126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdfsecured.mystrikingly.com",nocase; classtype:attempted-recon; sid:200003127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pecadotest.interwapp.com",nocase; classtype:attempted-recon; sid:200003128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pediaboard.in",nocase; classtype:attempted-recon; sid:200003129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pencakecwap.com",nocase; classtype:attempted-recon; sid:200003130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peppylids.co.uk",nocase; classtype:attempted-recon; sid:200003131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectliker.net",nocase; classtype:attempted-recon; sid:200003132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peringatanakunfb2k214.webnode.com",nocase; classtype:attempted-recon; sid:200003133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"periperioriginal.uk",nocase; classtype:attempted-recon; sid:200003134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"persons.servemp3.com",nocase; classtype:attempted-recon; sid:200003135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peru.payulatam.com",nocase; classtype:attempted-recon; sid:200003136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"petesappliancesllc.com",nocase; classtype:attempted-recon; sid:200003137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phc56741.wixsite.com",nocase; classtype:attempted-recon; sid:200003138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphicocobella.com",nocase; classtype:attempted-recon; sid:200003139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphihotelgroup.com",nocase; classtype:attempted-recon; sid:200003140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phishingloginmicrosoftonlinecom.zerotrustcorp.workers.dev",nocase; classtype:attempted-recon; sid:200003141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phishmetraining.co.uk",nocase; classtype:attempted-recon; sid:200003142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phlexx.com",nocase; classtype:attempted-recon; sid:200003143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photoartstavrinos.com",nocase; classtype:attempted-recon; sid:200003144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photoboothsrock.com.au",nocase; classtype:attempted-recon; sid:200003145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phreshphoto.com",nocase; classtype:attempted-recon; sid:200003146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phx.chromeproxy.net",nocase; classtype:attempted-recon; sid:200003147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pibs-service.cc",nocase; classtype:attempted-recon; sid:200003148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichiactivate711.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichin-web.ihostfull.com",nocase; classtype:attempted-recon; sid:200003150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichnchaaban134.ihostfull.com",nocase; classtype:attempted-recon; sid:200003151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pickonacctnflixsubsrenewal.com",nocase; classtype:attempted-recon; sid:200003152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"picnic.industries",nocase; classtype:attempted-recon; sid:200003153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pics.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200003154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pievedevensacorangefr.ctcin.bio",nocase; classtype:attempted-recon; sid:200003155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"piffvancouver.com",nocase; classtype:attempted-recon; sid:200003156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikaresailing.com",nocase; classtype:attempted-recon; sid:200003157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikay13.github.io",nocase; classtype:attempted-recon; sid:200003158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikirankitooyamang.co.vu",nocase; classtype:attempted-recon; sid:200003159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikirankitooyamang.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200003160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pin.verify-pin.com",nocase; classtype:attempted-recon; sid:200003161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pingpoing.com",nocase; classtype:attempted-recon; sid:200003162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkybeautybar.com",nocase; classtype:attempted-recon; sid:200003163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pips.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200003164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pirana.co.rs",nocase; classtype:attempted-recon; sid:200003165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pis.digitic.io",nocase; classtype:attempted-recon; sid:200003166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pixelbenchmarks.com",nocase; classtype:attempted-recon; sid:200003167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pizzaboy.pk",nocase; classtype:attempted-recon; sid:200003168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pjdhxpa.cn",nocase; classtype:attempted-recon; sid:200003169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pkk.depok.go.id",nocase; classtype:attempted-recon; sid:200003170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl-19.ru",nocase; classtype:attempted-recon; sid:200003171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl.pl2021.ru",nocase; classtype:attempted-recon; sid:200003172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl6n07xyxd.cbafisbsc18869ztrcv6qrackel.com",nocase; classtype:attempted-recon; sid:200003173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plain-bird-ee0e.jim-isaac10001.workers.dev",nocase; classtype:attempted-recon; sid:200003174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plain-bush-2ed3.dhlcaredmxcarelogin.workers.dev",nocase; classtype:attempted-recon; sid:200003175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plan-o2-monthlypayments.com",nocase; classtype:attempted-recon; sid:200003176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"planetaamor.org",nocase; classtype:attempted-recon; sid:200003177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasticaindia.com",nocase; classtype:attempted-recon; sid:200003178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plataformaeducativa.se.jalisco.gob.mx",nocase; classtype:attempted-recon; sid:200003179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"platform-filters.829-devl2.com",nocase; classtype:attempted-recon; sid:200003180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"platinumserviceac.com",nocase; classtype:attempted-recon; sid:200003181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"play.infocoweb.com.br",nocase; classtype:attempted-recon; sid:200003182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"playful-legend-aragosaurus.glitch.me",nocase; classtype:attempted-recon; sid:200003183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"playgirlgold.com",nocase; classtype:attempted-recon; sid:200003184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plaz.getthis4free.com",nocase; classtype:attempted-recon; sid:200003185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plugmailextraexpiredoldpolicynotificationscenter.pages.dev",nocase; classtype:attempted-recon; sid:200003186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plush.my",nocase; classtype:attempted-recon; sid:200003187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmbonline.unmuha.ac.id",nocase; classtype:attempted-recon; sid:200003188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pnycrk.cn",nocase; classtype:attempted-recon; sid:200003189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pnyyrr.cn",nocase; classtype:attempted-recon; sid:200003190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poc-rewards-program-c2dfc.web.app",nocase; classtype:attempted-recon; sid:200003191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"podpera-mbank.cz.swtest.ru",nocase; classtype:attempted-recon; sid:200003192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"podpiska-darom.ru",nocase; classtype:attempted-recon; sid:200003193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pokajca.web.app",nocase; classtype:attempted-recon; sid:200003194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"policy-violation-review193.xyz",nocase; classtype:attempted-recon; sid:200003195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poligrafiapias.com",nocase; classtype:attempted-recon; sid:200003196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkadot-france.fr",nocase; classtype:attempted-recon; sid:200003197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pope0w.webwave.dev",nocase; classtype:attempted-recon; sid:200003198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portail-news.in",nocase; classtype:attempted-recon; sid:200003199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal-o2uk.com",nocase; classtype:attempted-recon; sid:200003200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; classtype:attempted-recon; sid:200003201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pos-tbonk-autho.cloudaccess.host",nocase; classtype:attempted-recon; sid:200003202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pose.hyer.page",nocase; classtype:attempted-recon; sid:200003203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-arita-1391.mond.jp",nocase; classtype:attempted-recon; sid:200003204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-ch-de.34224.info",nocase; classtype:attempted-recon; sid:200003205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-ch-de.65241.org",nocase; classtype:attempted-recon; sid:200003206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-track.ch",nocase; classtype:attempted-recon; sid:200003207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post.driftdia.com",nocase; classtype:attempted-recon; sid:200003208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posta-romana.ml",nocase; classtype:attempted-recon; sid:200003209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posta-sk.top",nocase; classtype:attempted-recon; sid:200003210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaledsp2.conexion.fr.savealifemw.org",nocase; classtype:attempted-recon; sid:200003211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalfees-uk.com",nocase; classtype:attempted-recon; sid:200003212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalservicesuk.com",nocase; classtype:attempted-recon; sid:200003213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalukservice.com",nocase; classtype:attempted-recon; sid:200003214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postch9192.cargo.site",nocase; classtype:attempted-recon; sid:200003215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posten-forsendelsevhost198254.lowhost.ru",nocase; classtype:attempted-recon; sid:200003216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postennorsupportnor.online",nocase; classtype:attempted-recon; sid:200003217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice61-t.neolane.net",nocase; classtype:attempted-recon; sid:200003218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powercase.shoplineapp.com",nocase; classtype:attempted-recon; sid:200003219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powertech-solutions-elevator.com",nocase; classtype:attempted-recon; sid:200003220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pp-aid.com",nocase; classtype:attempted-recon; sid:200003221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppaylbctrans.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppdaproviders.ug",nocase; classtype:attempted-recon; sid:200003223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pppp.org.pk",nocase; classtype:attempted-recon; sid:200003224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pr0c3ss3d00-c0mf1rmc3nt3r.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pr1v4t3d00-s3tt1ng0p.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prepaid.firstdata.com",nocase; classtype:attempted-recon; sid:200003227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"preppingconfidence.com",nocase; classtype:attempted-recon; sid:200003228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prernaindustries.com",nocase; classtype:attempted-recon; sid:200003229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pretadsge.duckdns.org",nocase; classtype:attempted-recon; sid:200003230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prevencionvialbcpzonaseguras.esc-pons.com",nocase; classtype:attempted-recon; sid:200003231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikany.com",nocase; classtype:attempted-recon; sid:200003232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikolnaya.com",nocase; classtype:attempted-recon; sid:200003233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prime.a80113.shop",nocase; classtype:attempted-recon; sid:200003234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prime.foodpanda4.tokyo",nocase; classtype:attempted-recon; sid:200003235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prime.ppp0003.shop",nocase; classtype:attempted-recon; sid:200003236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prime.shop-onlinene.shop",nocase; classtype:attempted-recon; sid:200003237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primecentral.jiwangkailai6.shop",nocase; classtype:attempted-recon; sid:200003238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primecentral.shop002.shop",nocase; classtype:attempted-recon; sid:200003239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primecentral.vankermall.shop",nocase; classtype:attempted-recon; sid:200003240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"princecly.com",nocase; classtype:attempted-recon; sid:200003241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"printigo.co.in",nocase; classtype:attempted-recon; sid:200003242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"printtoner.com.mx",nocase; classtype:attempted-recon; sid:200003243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-page-prtections-association-recovry-secu.web.id",nocase; classtype:attempted-recon; sid:200003244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovry-page-protection-4565544.web.id",nocase; classtype:attempted-recon; sid:200003245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovry-page-protection-comunity-45.web.id",nocase; classtype:attempted-recon; sid:200003246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacygxterms.yolasite.com",nocase; classtype:attempted-recon; sid:200003247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.anon-rest-keep-reset.sales18130.workers.dev",nocase; classtype:attempted-recon; sid:200003248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.anon-step-keep-object.sales18130.workers.dev",nocase; classtype:attempted-recon; sid:200003249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.dry-snow-ddc20ffice.deuceice2.workers.dev",nocase; classtype:attempted-recon; sid:200003250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.keep-paper-account.sales18130.workers.dev",nocase; classtype:attempted-recon; sid:200003251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.lively-salad-1c42.updatelogaccountprogramedrfwerwrdhsmc.workers.dev",nocase; classtype:attempted-recon; sid:200003252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.microsodrpassword-blis02939-stroageclpidp-ingering-shape-b2ab.lllibby-webb6868.workers.dev",nocase; classtype:attempted-recon; sid:200003253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.microsoftpassword-update0090-updatemicros0-calm-silence-ce7f.pedrogonzalezmxamrocom.workers.dev",nocase; classtype:attempted-recon; sid:200003254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.microsoftpassword00-misockas090-ja104008d-storagespasturn.pedrogonzalezmxamrocom.workers.dev",nocase; classtype:attempted-recon; sid:200003255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.microsoftpassword009-updatepassword00-ja09square-term-484a.lllibby-webb6868.workers.dev",nocase; classtype:attempted-recon; sid:200003256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.noisy-frost-2d74.keep-noreply-always.workers.dev",nocase; classtype:attempted-recon; sid:200003257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.odpasswordupdate-outlook365-microsoftpasswor0mpatient-pond-1e5c.pedrogonzalezmxamrocom.workers.dev",nocase; classtype:attempted-recon; sid:200003258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.ojmicrosoftapassio-oj00lk-storagesecuredpddff.pedrogonzalezmxamrocom.workers.dev",nocase; classtype:attempted-recon; sid:200003259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.passtruth-truth-5df4.pass-morn-reset-todaybringsjoy.workers.dev",nocase; classtype:attempted-recon; sid:200003260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.passwordupdate00-microsoftpasswordupdate00-odragrant-tooth-3351.lllibby-webb6868.workers.dev",nocase; classtype:attempted-recon; sid:200003261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.steep-poetry-1ba3.updatelogaccountprogramedrfwerwrdhscsw.workers.dev",nocase; classtype:attempted-recon; sid:200003262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.try-murpheos-keep.sales18130.workers.dev",nocase; classtype:attempted-recon; sid:200003263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.twilight-darkness-9e4b.updatelogaccountprogramedrfwerwrdhscsw.workers.dev",nocase; classtype:attempted-recon; sid:200003264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"production.verify.dasboard-secur-page.workers.dev",nocase; classtype:attempted-recon; sid:200003265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"productkeyforfree.com",nocase; classtype:attempted-recon; sid:200003266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"professional-house-cleaning.ca",nocase; classtype:attempted-recon; sid:200003267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"professionalsound.com",nocase; classtype:attempted-recon; sid:200003268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"profil-taxsclaimusa.serveftp.com",nocase; classtype:attempted-recon; sid:200003269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"programatarjetarosa.com",nocase; classtype:attempted-recon; sid:200003270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"projectlovewell.com",nocase; classtype:attempted-recon; sid:200003271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promehedinti.ro",nocase; classtype:attempted-recon; sid:200003272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaltda.com",nocase; classtype:attempted-recon; sid:200003273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promo.mycorporate-rewards.net",nocase; classtype:attempted-recon; sid:200003274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prompting.myvnc.com",nocase; classtype:attempted-recon; sid:200003275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"propertyxplore.com",nocase; classtype:attempted-recon; sid:200003276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosibvolley.com",nocase; classtype:attempted-recon; sid:200003277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosxsiuser.myfreesites.net",nocase; classtype:attempted-recon; sid:200003278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protecpageidentityrecovery.ga",nocase; classtype:attempted-recon; sid:200003279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect-4d56vca.surge.sh",nocase; classtype:attempted-recon; sid:200003280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect.theresortweddings.com",nocase; classtype:attempted-recon; sid:200003281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protectiions-recovry.freecluster.eu",nocase; classtype:attempted-recon; sid:200003282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protection.safety-pages.facebook-accts.workers.dev",nocase; classtype:attempted-recon; sid:200003283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protectionsandstndardupdates.gq",nocase; classtype:attempted-recon; sid:200003284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"psicolfis.com",nocase; classtype:attempted-recon; sid:200003285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"psupport.apple.com.pple.com",nocase; classtype:attempted-recon; sid:200003286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pt08.com",nocase; classtype:attempted-recon; sid:200003287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ptxx.cc",nocase; classtype:attempted-recon; sid:200003288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"publish-p43452-e180057.adobeaemcloud.com",nocase; classtype:attempted-recon; sid:200003289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pueblodemochileros.com",nocase; classtype:attempted-recon; sid:200003290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puffing.com.pk",nocase; classtype:attempted-recon; sid:200003291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pulsapaypal.co.id",nocase; classtype:attempted-recon; sid:200003292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"punccakeswup.finance",nocase; classtype:attempted-recon; sid:200003293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puroxymembrane.com",nocase; classtype:attempted-recon; sid:200003294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pvybggf.cn",nocase; classtype:attempted-recon; sid:200003295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pydttuxozmzjmjqxayxfxhycfr-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q06huk.webwave.dev",nocase; classtype:attempted-recon; sid:200003297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q8bet.net",nocase; classtype:attempted-recon; sid:200003298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; classtype:attempted-recon; sid:200003299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qbocd.csb.app",nocase; classtype:attempted-recon; sid:200003300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qf3nt.codesandbox.io",nocase; classtype:attempted-recon; sid:200003302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qfw.tosex35238.workers.dev",nocase; classtype:attempted-recon; sid:200003303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qhmqhgnfqbcoxkwamsioilhdmv-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qiusnim.cc",nocase; classtype:attempted-recon; sid:200003305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qnnzon.info",nocase; classtype:attempted-recon; sid:200003306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quickqatar.com",nocase; classtype:attempted-recon; sid:200003307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quinaroja.com",nocase; classtype:attempted-recon; sid:200003308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quirky-dewdney.134-209-94-153.plesk.page",nocase; classtype:attempted-recon; sid:200003309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quirky-wiles.107-175-123-35.plesk.page",nocase; classtype:attempted-recon; sid:200003310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quota.creatorlink.net",nocase; classtype:attempted-recon; sid:200003311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qusarv.consisavrt.com.br",nocase; classtype:attempted-recon; sid:200003312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.rx-ci-ser.net",nocase; classtype:attempted-recon; sid:200003313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r3-v3r1fy-p4g3r3p0t3d.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabellartz.de",nocase; classtype:attempted-recon; sid:200003315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; classtype:attempted-recon; sid:200003316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.li",nocase; classtype:attempted-recon; sid:200003317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rackenfordlabs.com",nocase; classtype:attempted-recon; sid:200003318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"racuncinta-indonesia.com",nocase; classtype:attempted-recon; sid:200003319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"radioseek.net",nocase; classtype:attempted-recon; sid:200003320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rafaentulhos.com.br",nocase; classtype:attempted-recon; sid:200003321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raffermeniac.github.io",nocase; classtype:attempted-recon; sid:200003322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"railing44.com",nocase; classtype:attempted-recon; sid:200003323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raipurrussianescorts.com",nocase; classtype:attempted-recon; sid:200003324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rajwebtechnology.com",nocase; classtype:attempted-recon; sid:200003325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.buogfbizkugf.gq",nocase; classtype:attempted-recon; sid:200003326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.bycsaxwdqunhh.gq",nocase; classtype:attempted-recon; sid:200003327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-card.motpefhnpvyz.gq",nocase; classtype:attempted-recon; sid:200003328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktuen.laobanlocker.com",nocase; classtype:attempted-recon; sid:200003329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktuen.qoorie.com",nocase; classtype:attempted-recon; sid:200003330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuten.co.jp.oadkxoe.cf",nocase; classtype:attempted-recon; sid:200003331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuten.co.jp.ravtenip.xyz",nocase; classtype:attempted-recon; sid:200003332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuten.sfvw.top",nocase; classtype:attempted-recon; sid:200003333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakutern.co.jp.g6zc.cn",nocase; classtype:attempted-recon; sid:200003334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakutern.co.jp.pnm6.cn",nocase; classtype:attempted-recon; sid:200003335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ramgarhiamatrimonial.ca",nocase; classtype:attempted-recon; sid:200003336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"randomstring.electrumproject.su",nocase; classtype:attempted-recon; sid:200003337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ranging.servehttp.com",nocase; classtype:attempted-recon; sid:200003338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rankuton.njhgkj.cn",nocase; classtype:attempted-recon; sid:200003339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rapide-verification-de-sercod-bp-fr.prohoster.biz",nocase; classtype:attempted-recon; sid:200003340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rareelements.io",nocase; classtype:attempted-recon; sid:200003341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ratewatch.net",nocase; classtype:attempted-recon; sid:200003342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raycargo.com",nocase; classtype:attempted-recon; sid:200003343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raydiom.io",nocase; classtype:attempted-recon; sid:200003344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raydium-app.org",nocase; classtype:attempted-recon; sid:200003345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbcmontgomery.com",nocase; classtype:attempted-recon; sid:200003346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbitservices.co.uk",nocase; classtype:attempted-recon; sid:200003347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rcproductionsjm.com",nocase; classtype:attempted-recon; sid:200003348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rd8um.app.link",nocase; classtype:attempted-recon; sid:200003349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rdresearchtechnology.com",nocase; classtype:attempted-recon; sid:200003350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-bu-il-der.xyz",nocase; classtype:attempted-recon; sid:200003351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-direct-me.com",nocase; classtype:attempted-recon; sid:200003352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-redirection-acc-id923872635122.blogspot.com",nocase; classtype:attempted-recon; sid:200003353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real-anon-keep-passing-word.rvsla.workers.dev",nocase; classtype:attempted-recon; sid:200003354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realclub.de",nocase; classtype:attempted-recon; sid:200003355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realcodashopfreediamonds.freeddns.com",nocase; classtype:attempted-recon; sid:200003356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realdatatest.isolusi-bf.com",nocase; classtype:attempted-recon; sid:200003357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestate-page-10843446024.expresspestcontrol.co.nz",nocase; classtype:attempted-recon; sid:200003358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestateagentlisting.tv",nocase; classtype:attempted-recon; sid:200003359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestateexuma.com",nocase; classtype:attempted-recon; sid:200003360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realhypermarket.me",nocase; classtype:attempted-recon; sid:200003361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realindiatravel.com",nocase; classtype:attempted-recon; sid:200003362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realityspeaks.org",nocase; classtype:attempted-recon; sid:200003363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realmoneysend.com",nocase; classtype:attempted-recon; sid:200003364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recargajogo.me",nocase; classtype:attempted-recon; sid:200003365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rechtsanwaltskanzlei-spanien.de",nocase; classtype:attempted-recon; sid:200003366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recomfirmidentity-pagecenter.ga",nocase; classtype:attempted-recon; sid:200003367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reconfirmpageswarningidentityservice.co.vu",nocase; classtype:attempted-recon; sid:200003368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reconfirmpost287846656.us",nocase; classtype:attempted-recon; sid:200003369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recovery-fb.secure-acct.workers.dev",nocase; classtype:attempted-recon; sid:200003370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"red-limit-db0e.chseonlinelogins.workers.dev",nocase; classtype:attempted-recon; sid:200003371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redbysfrgroupebox.myfreesites.net",nocase; classtype:attempted-recon; sid:200003372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redeabreu.com.br",nocase; classtype:attempted-recon; sid:200003373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redeem-microsoft-code.sitey.me",nocase; classtype:attempted-recon; sid:200003374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rediractionid547012016089540218057.blogspot.com",nocase; classtype:attempted-recon; sid:200003375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirection-messagerie-reactivation.bomberoslimache.cl",nocase; classtype:attempted-recon; sid:200003376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reformotucasa.com",nocase; classtype:attempted-recon; sid:200003377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regina.ninetendev.com",nocase; classtype:attempted-recon; sid:200003378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regisdrive.xyz",nocase; classtype:attempted-recon; sid:200003379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"register-click.club",nocase; classtype:attempted-recon; sid:200003380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"register-my-device.com",nocase; classtype:attempted-recon; sid:200003381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registerdrive.xyz",nocase; classtype:attempted-recon; sid:200003382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registro-online-bd.com",nocase; classtype:attempted-recon; sid:200003383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registromodelo-com.filesusr.com",nocase; classtype:attempted-recon; sid:200003384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reglic.in",nocase; classtype:attempted-recon; sid:200003385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regularbui.xyz",nocase; classtype:attempted-recon; sid:200003386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regularsweeps.xyz",nocase; classtype:attempted-recon; sid:200003387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reignbike.com",nocase; classtype:attempted-recon; sid:200003388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reikisadhna.com",nocase; classtype:attempted-recon; sid:200003389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"relevant.systems",nocase; classtype:attempted-recon; sid:200003390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remedy.3utilities.com",nocase; classtype:attempted-recon; sid:200003391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remittance369297292749.goshly.com",nocase; classtype:attempted-recon; sid:200003392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remove-reject.link",nocase; classtype:attempted-recon; sid:200003393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rendangunitutie.com",nocase; classtype:attempted-recon; sid:200003394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"renkntee.n1s5kc.cn",nocase; classtype:attempted-recon; sid:200003395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"renovkonstruksi.com",nocase; classtype:attempted-recon; sid:200003396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reoauthv1online-login.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200003397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"repl-mess.myfreesites.net",nocase; classtype:attempted-recon; sid:200003398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"replug.link",nocase; classtype:attempted-recon; sid:200003399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"require.servepics.com",nocase; classtype:attempted-recon; sid:200003400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbet.blogspot.com",nocase; classtype:attempted-recon; sid:200003401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbetsgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200003402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resgateponto.me",nocase; classtype:attempted-recon; sid:200003403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200003404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200003405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200003406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restore-meta-mask-page.com",nocase; classtype:attempted-recon; sid:200003407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resu.page.link",nocase; classtype:attempted-recon; sid:200003408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retiro-extracash.com",nocase; classtype:attempted-recon; sid:200003409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retiro.cl",nocase; classtype:attempted-recon; sid:200003410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retraiteenaction.ca",nocase; classtype:attempted-recon; sid:200003411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retrospectiveplanningenforcementwestsussex.co.uk",nocase; classtype:attempted-recon; sid:200003412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review-mynew-device.com",nocase; classtype:attempted-recon; sid:200003413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reviewbook.org",nocase; classtype:attempted-recon; sid:200003414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revistametro.com.ar",nocase; classtype:attempted-recon; sid:200003415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revolution-1000022233349786513212345678912331.gq",nocase; classtype:attempted-recon; sid:200003416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revolution-1000022233349786513212345678912332.gq",nocase; classtype:attempted-recon; sid:200003417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rextraening.dk",nocase; classtype:attempted-recon; sid:200003418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rfeldman.russellfeldman.com",nocase; classtype:attempted-recon; sid:200003419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rheincargo.co.in",nocase; classtype:attempted-recon; sid:200003420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhilo.co.in",nocase; classtype:attempted-recon; sid:200003421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"richardbashara.com",nocase; classtype:attempted-recon; sid:200003422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rimbun-group.com",nocase; classtype:attempted-recon; sid:200003423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riotgames-2iaxnc-league-of-legends.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riptide-operation.ru.com",nocase; classtype:attempted-recon; sid:200003425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rizarichempire.com",nocase; classtype:attempted-recon; sid:200003426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rizkyinterior.com",nocase; classtype:attempted-recon; sid:200003427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkanet.com",nocase; classtype:attempted-recon; sid:200003428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkt-check.at10i.info",nocase; classtype:attempted-recon; sid:200003429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkt-check.at3i.info",nocase; classtype:attempted-recon; sid:200003430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkt-check.at5i.info",nocase; classtype:attempted-recon; sid:200003431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rlink.vn",nocase; classtype:attempted-recon; sid:200003432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmsfcc.com",nocase; classtype:attempted-recon; sid:200003433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmzengenharia.blogspot.com",nocase; classtype:attempted-recon; sid:200003434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roadgo.co.uk",nocase; classtype:attempted-recon; sid:200003435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roblox-robux-free.club.netflixfree.icu",nocase; classtype:attempted-recon; sid:200003436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200003437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roisnoob.github.io",nocase; classtype:attempted-recon; sid:200003438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rolinadd.surveysparrow.com",nocase; classtype:attempted-recon; sid:200003439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronces.co.vu",nocase; classtype:attempted-recon; sid:200003440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rondelbarrilito.com",nocase; classtype:attempted-recon; sid:200003441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet-connect.com",nocase; classtype:attempted-recon; sid:200003442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet.cm",nocase; classtype:attempted-recon; sid:200003443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rosalinas-initial-project-30ac52.webflow.io",nocase; classtype:attempted-recon; sid:200003444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotimi.pandaform.com",nocase; classtype:attempted-recon; sid:200003445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roudrde.com",nocase; classtype:attempted-recon; sid:200003446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"round-union-2663.updatedloginprocesss.workers.dev",nocase; classtype:attempted-recon; sid:200003447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundcube-2c46f.web.app",nocase; classtype:attempted-recon; sid:200003448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundcube-production-cf.tx1.mailhostbox.com",nocase; classtype:attempted-recon; sid:200003449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roupakids.blogspot.com",nocase; classtype:attempted-recon; sid:200003450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalpostcards.be",nocase; classtype:attempted-recon; sid:200003451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalwindsorpub.com",nocase; classtype:attempted-recon; sid:200003452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rplg.co",nocase; classtype:attempted-recon; sid:200003454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rreeufffsaussaa3.app.link",nocase; classtype:attempted-recon; sid:200003455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rseauxmobile01.ulcraft.com",nocase; classtype:attempted-recon; sid:200003456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsp.ogivart.us",nocase; classtype:attempted-recon; sid:200003457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rstools.club",nocase; classtype:attempted-recon; sid:200003458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsujkblokqlyqfonpzgztejdji-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rtk-check-info3.8-co.top",nocase; classtype:attempted-recon; sid:200003460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rtk-check-info5.12-co.top",nocase; classtype:attempted-recon; sid:200003461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rtk-info2.5-co.top",nocase; classtype:attempted-recon; sid:200003462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rtk-info3.3-co.top",nocase; classtype:attempted-recon; sid:200003463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ruekrew.com",nocase; classtype:attempted-recon; sid:200003464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ruenescape.com",nocase; classtype:attempted-recon; sid:200003465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ruggalaxy.com.au",nocase; classtype:attempted-recon; sid:200003466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rugworldauburn.com.au",nocase; classtype:attempted-recon; sid:200003467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescape.secure.com-ws81541053421952453.ru",nocase; classtype:attempted-recon; sid:200003468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"russs123.github.io",nocase; classtype:attempted-recon; sid:200003469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s-sarfati.co.il",nocase; classtype:attempted-recon; sid:200003470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.aecosmanzm.com",nocase; classtype:attempted-recon; sid:200003471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.aoeaomsnexc.com",nocase; classtype:attempted-recon; sid:200003472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.aoemsiecsan.com",nocase; classtype:attempted-recon; sid:200003473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.axcsnameocz.com",nocase; classtype:attempted-recon; sid:200003474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.casscard.com",nocase; classtype:attempted-recon; sid:200003475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.ccaemcd.com",nocase; classtype:attempted-recon; sid:200003476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.coesacd.com",nocase; classtype:attempted-recon; sid:200003477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.free.fr",nocase; classtype:attempted-recon; sid:200003478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.mcsemrini.com",nocase; classtype:attempted-recon; sid:200003479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.measeriiei.com",nocase; classtype:attempted-recon; sid:200003480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.mmceoci.com",nocase; classtype:attempted-recon; sid:200003481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.yam.com",nocase; classtype:attempted-recon; sid:200003482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s0rt1ngc3nt3r-c0mf1rm4t10n.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3rv1c3-0rg4n1z3rs1t3d.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s5vzr.app.link",nocase; classtype:attempted-recon; sid:200003485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sabssyndicate.com.bd",nocase; classtype:attempted-recon; sid:200003486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sacred.servegame.com",nocase; classtype:attempted-recon; sid:200003487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sadervoyages.intnet.mu",nocase; classtype:attempted-recon; sid:200003488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safakoto.com.tr",nocase; classtype:attempted-recon; sid:200003489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safety.insecur-page.workers.dev",nocase; classtype:attempted-recon; sid:200003490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safetyconsultantehs.com",nocase; classtype:attempted-recon; sid:200003491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safetysmitama.net",nocase; classtype:attempted-recon; sid:200003492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200003493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgiristikla.blogspot.com",nocase; classtype:attempted-recon; sid:200003494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahc892190jf19y83.yicori5768-t0ypy-yy.workers.dev",nocase; classtype:attempted-recon; sid:200003495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahj.6etlpqp6tq9295.workers.dev",nocase; classtype:attempted-recon; sid:200003496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahyacollege.com",nocase; classtype:attempted-recon; sid:200003497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saitadobrasil.com.br",nocase; classtype:attempted-recon; sid:200003498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; classtype:attempted-recon; sid:200003499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saldospc.com",nocase; classtype:attempted-recon; sid:200003500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"salemarten.com",nocase; classtype:attempted-recon; sid:200003501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saliksnas.lojaintegrada.com.br",nocase; classtype:attempted-recon; sid:200003502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"salmon-cliff-02133620f.azurestaticapps.net",nocase; classtype:attempted-recon; sid:200003503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samihalyaman.com",nocase; classtype:attempted-recon; sid:200003504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samvaadlife.com",nocase; classtype:attempted-recon; sid:200003505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samvoktor.com",nocase; classtype:attempted-recon; sid:200003506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanasunty.site",nocase; classtype:attempted-recon; sid:200003507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandboxww.top",nocase; classtype:attempted-recon; sid:200003508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandeeppk03.github.io",nocase; classtype:attempted-recon; sid:200003509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandhu.codebucketitsolutions.com",nocase; classtype:attempted-recon; sid:200003510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandhursttandoori.co.uk",nocase; classtype:attempted-recon; sid:200003511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sangahqw1.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjilkumar.com",nocase; classtype:attempted-recon; sid:200003513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sankyo-rz.com",nocase; classtype:attempted-recon; sid:200003514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanrite.page.link",nocase; classtype:attempted-recon; sid:200003515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanru.cd",nocase; classtype:attempted-recon; sid:200003516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santepluspharma.eclatmediasolution.website",nocase; classtype:attempted-recon; sid:200003517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santoshdangi.com.np",nocase; classtype:attempted-recon; sid:200003518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saritapariyar.com.np",nocase; classtype:attempted-recon; sid:200003519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satay-secur.reconfimations.pagedisabled.workers.dev",nocase; classtype:attempted-recon; sid:200003520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satclient-p1.web.app",nocase; classtype:attempted-recon; sid:200003521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"satemi.com.ve",nocase; classtype:attempted-recon; sid:200003522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saumedia.com",nocase; classtype:attempted-recon; sid:200003523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"savingsfordentalcare.com",nocase; classtype:attempted-recon; sid:200003524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sayangabghabibi.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbi.mx",nocase; classtype:attempted-recon; sid:200003526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sblocco.dati.rolatrims.com",nocase; classtype:attempted-recon; sid:200003527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbs-siebanlagen.de",nocase; classtype:attempted-recon; sid:200003528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbvakifhepsizlerle.com",nocase; classtype:attempted-recon; sid:200003529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scalper.one",nocase; classtype:attempted-recon; sid:200003530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scanimg.onrender.com",nocase; classtype:attempted-recon; sid:200003531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scb9813h918fh9831821yh.pefecim563-oiuyt-oijh.workers.dev",nocase; classtype:attempted-recon; sid:200003532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sceposm.ceeeood.com",nocase; classtype:attempted-recon; sid:200003533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schneider.net.ua",nocase; classtype:attempted-recon; sid:200003534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schroffenstein.online.fr",nocase; classtype:attempted-recon; sid:200003535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scotiabank-yieldmorefinancing.ca",nocase; classtype:attempted-recon; sid:200003536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scrtypagesrcvry.co.vu",nocase; classtype:attempted-recon; sid:200003537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sd.ecofurnituregh.com",nocase; classtype:attempted-recon; sid:200003538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdgmjgvjvgj.sayamu33a90scuy981f.workers.dev",nocase; classtype:attempted-recon; sid:200003539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdgvsdvsdvs.blogspot.com",nocase; classtype:attempted-recon; sid:200003540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seaglorybd.com",nocase; classtype:attempted-recon; sid:200003541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seahoss.com",nocase; classtype:attempted-recon; sid:200003542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seanquincytv.com",nocase; classtype:attempted-recon; sid:200003543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"searchclearwaterbeachproperties.com",nocase; classtype:attempted-recon; sid:200003544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebat-dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200003545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebene27.github.io",nocase; classtype:attempted-recon; sid:200003546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seceta.ro",nocase; classtype:attempted-recon; sid:200003547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secur-client.com",nocase; classtype:attempted-recon; sid:200003548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-boncoincontrol.net",nocase; classtype:attempted-recon; sid:200003549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-citi32.serveuser.com",nocase; classtype:attempted-recon; sid:200003550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-halifax-device.com",nocase; classtype:attempted-recon; sid:200003551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-monitor.com",nocase; classtype:attempted-recon; sid:200003552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-mynew-devices.com",nocase; classtype:attempted-recon; sid:200003553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-p0stal.blogspot.com",nocase; classtype:attempted-recon; sid:200003554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-runescape.xgm.rnp.mybluehost.me",nocase; classtype:attempted-recon; sid:200003555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-ssl-cdn.com",nocase; classtype:attempted-recon; sid:200003556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-webshare01.com",nocase; classtype:attempted-recon; sid:200003557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.getinhank.com",nocase; classtype:attempted-recon; sid:200003558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.legalmetric.com",nocase; classtype:attempted-recon; sid:200003559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.oldschool.com-eg.ru",nocase; classtype:attempted-recon; sid:200003560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.oldschool.com-fr.ru",nocase; classtype:attempted-recon; sid:200003561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.oldschool.com-zz.ru",nocase; classtype:attempted-recon; sid:200003562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-as.cz",nocase; classtype:attempted-recon; sid:200003563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200003564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200003565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-rse.ru",nocase; classtype:attempted-recon; sid:200003566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-rsu.ru",nocase; classtype:attempted-recon; sid:200003567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-vc.ru",nocase; classtype:attempted-recon; sid:200003568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200003569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure02b-chase.com-web-auth-onlineenrollment.duckdns.org",nocase; classtype:attempted-recon; sid:200003570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure300.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200003571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure303.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200003572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securebasenetflix001.duckdns.org",nocase; classtype:attempted-recon; sid:200003573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securebtbusinesssecuremybt.weebly.com",nocase; classtype:attempted-recon; sid:200003574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securedwalletswap.com",nocase; classtype:attempted-recon; sid:200003575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securefaxing.knorish.com",nocase; classtype:attempted-recon; sid:200003576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securegateway-ovhcloud.csl-sl.de",nocase; classtype:attempted-recon; sid:200003577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securegateway-ovhcloud.ss-sll.com",nocase; classtype:attempted-recon; sid:200003578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securelloyd-help-app.com",nocase; classtype:attempted-recon; sid:200003579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securelogononline.com",nocase; classtype:attempted-recon; sid:200003580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"security-page-community-standards.blogspot.com",nocase; classtype:attempted-recon; sid:200003581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securitycenter.microsoft.us.admin-mcas-gov.ms",nocase; classtype:attempted-recon; sid:200003582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secuure03verilfy.4dq.com",nocase; classtype:attempted-recon; sid:200003583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seetheworldtravels.com.au",nocase; classtype:attempted-recon; sid:200003584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguraweb4646373.hostfree.pw",nocase; classtype:attempted-recon; sid:200003585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridad89822.webcindario.com",nocase; classtype:attempted-recon; sid:200003586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seifer.io",nocase; classtype:attempted-recon; sid:200003587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss.blogspot.com",nocase; classtype:attempted-recon; sid:200003588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200003589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200003590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selahattindemirciogluasm.com",nocase; classtype:attempted-recon; sid:200003591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selector26.gg",nocase; classtype:attempted-recon; sid:200003592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"selector28.gg",nocase; classtype:attempted-recon; sid:200003593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sem.my-drs.co.uk",nocase; classtype:attempted-recon; sid:200003594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sen-manole.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sendo-meso.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"senger-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200003597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sertyxese.myfreesites.net",nocase; classtype:attempted-recon; sid:200003598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serv-secured-1.com",nocase; classtype:attempted-recon; sid:200003599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servadatamaintenanceserve.mfs.gg",nocase; classtype:attempted-recon; sid:200003600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servciosvalidacionseniiinia.com",nocase; classtype:attempted-recon; sid:200003601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-networksolutions.web.app",nocase; classtype:attempted-recon; sid:200003602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-sparkasse.de",nocase; classtype:attempted-recon; sid:200003603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serverupdate.getforge.io",nocase; classtype:attempted-recon; sid:200003604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicabbout.blogspot.com",nocase; classtype:attempted-recon; sid:200003605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-lkdn2020.gacconstrutora.com.br",nocase; classtype:attempted-recon; sid:200003606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service.csassistant06.com",nocase; classtype:attempted-recon; sid:200003607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicepage.service-page.workers.dev",nocase; classtype:attempted-recon; sid:200003608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-as.cz",nocase; classtype:attempted-recon; sid:200003609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200003610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200003611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-rsu.ru",nocase; classtype:attempted-recon; sid:200003612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200003613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-bb.xyz",nocase; classtype:attempted-recon; sid:200003614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-oq.xyz",nocase; classtype:attempted-recon; sid:200003615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-rm.xyz",nocase; classtype:attempted-recon; sid:200003616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-ua.xyz",nocase; classtype:attempted-recon; sid:200003617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesbancaire.com",nocase; classtype:attempted-recon; sid:200003618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciorce.com.mx",nocase; classtype:attempted-recon; sid:200003619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciosbndigitales.com",nocase; classtype:attempted-recon; sid:200003620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servics.validationsecuradm.workers.dev",nocase; classtype:attempted-recon; sid:200003621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servsr.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servweb.cf",nocase; classtype:attempted-recon; sid:200003623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settafa.com",nocase; classtype:attempted-recon; sid:200003624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settingsandprivacy.gq",nocase; classtype:attempted-recon; sid:200003625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setupmynorton.square.site",nocase; classtype:attempted-recon; sid:200003626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sevoudryserviciobomail.dudaone.com",nocase; classtype:attempted-recon; sid:200003627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfc.com.vn",nocase; classtype:attempted-recon; sid:200003628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sffsfsfsvvv.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfrpanel.lws.fr",nocase; classtype:attempted-recon; sid:200003630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sftp.usin.com",nocase; classtype:attempted-recon; sid:200003631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgsrsspxe9hj.wixsite.com",nocase; classtype:attempted-recon; sid:200003632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgtbalde991-dot-still-dynamics-321006.ue.r.appspot.com",nocase; classtype:attempted-recon; sid:200003633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shafischools.com",nocase; classtype:attempted-recon; sid:200003634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shainanailbeauty.com",nocase; classtype:attempted-recon; sid:200003635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shamajastore.co.ke",nocase; classtype:attempted-recon; sid:200003636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shambika.com",nocase; classtype:attempted-recon; sid:200003637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanestrailertraining.com",nocase; classtype:attempted-recon; sid:200003638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanky0.github.io",nocase; classtype:attempted-recon; sid:200003639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanza.epos.com.pk",nocase; classtype:attempted-recon; sid:200003640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-eu1.hsforms.com",nocase; classtype:attempted-recon; sid:200003641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.chamaileon.io",nocase; classtype:attempted-recon; sid:200003642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shared-file.square.site",nocase; classtype:attempted-recon; sid:200003643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharedfax815201376.wordpress.com",nocase; classtype:attempted-recon; sid:200003644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharedtris.com",nocase; classtype:attempted-recon; sid:200003645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharefile-hmugentristategt.org",nocase; classtype:attempted-recon; sid:200003646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharelink.sn.am",nocase; classtype:attempted-recon; sid:200003647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharestion.com",nocase; classtype:attempted-recon; sid:200003648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shfgj.cn",nocase; classtype:attempted-recon; sid:200003649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shiba-box.ltd",nocase; classtype:attempted-recon; sid:200003650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shikshamandir.com",nocase; classtype:attempted-recon; sid:200003651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shippingdhlservice-c44bf.web.app",nocase; classtype:attempted-recon; sid:200003652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shivrams.com",nocase; classtype:attempted-recon; sid:200003653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shiye666.cn",nocase; classtype:attempted-recon; sid:200003654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.cmfurnituremall.com",nocase; classtype:attempted-recon; sid:200003655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.ewerest-stroi.ru",nocase; classtype:attempted-recon; sid:200003656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.prunescape.com.au",nocase; classtype:attempted-recon; sid:200003657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopee.khogiaodien247.com",nocase; classtype:attempted-recon; sid:200003658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopee688.com",nocase; classtype:attempted-recon; sid:200003659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopifybooking.com",nocase; classtype:attempted-recon; sid:200003660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"short.npru.ac.th",nocase; classtype:attempted-recon; sid:200003661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shortenlink.top",nocase; classtype:attempted-recon; sid:200003662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shovalimyoqneam.co.il",nocase; classtype:attempted-recon; sid:200003663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"showcomputer.com",nocase; classtype:attempted-recon; sid:200003664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shreecauveryprints.com",nocase; classtype:attempted-recon; sid:200003665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siberistan.xyz",nocase; classtype:attempted-recon; sid:200003666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheit-spk-psd2.de",nocase; classtype:attempted-recon; sid:200003667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurezza-mywidiba-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200003668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurr-mtb.com",nocase; classtype:attempted-recon; sid:200003669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siemik.github.io",nocase; classtype:attempted-recon; sid:200003670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siescadetcollegeabbottabad.com",nocase; classtype:attempted-recon; sid:200003671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signature-notes.com",nocase; classtype:attempted-recon; sid:200003672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin-gcq7uwojrw58brcckylebjuy39nk2ivt65ol39k6ut6ura94zk.website.yandexcloud.net",nocase; classtype:attempted-recon; sid:200003673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin-payeer.com",nocase; classtype:attempted-recon; sid:200003674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaawyi.sapi.dllsignin.usingssl.1qbwhg23f7o1boo4johx5voccstfa.amountsc.shop",nocase; classtype:attempted-recon; sid:200003675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dll.signin.using.ssl.ktvfdwssddpbwl5wr7ftfplzhbrjz7.vursssle.xyz",nocase; classtype:attempted-recon; sid:200003676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dll.signin.using.ssl.vpmin2cg9bv2kedsrbfkqzzsaeptqg.bursssle.shop",nocase; classtype:attempted-recon; sid:200003677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dll.signin.using.ssl.vrsyisgn7ehj7hgj67mnxoyvyqsa5s.vursssle.shop",nocase; classtype:attempted-recon; sid:200003678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dll.signin.usingssl.ikloaanmwl3ryw5acgqxwqs2cclo5.amountsc.xyz",nocase; classtype:attempted-recon; sid:200003679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.eday.co.uk.ws.eaayi.sapi.dllsignin.usingssl.xtopghbftpk8ydnqcwoqq4sokmmaa.amountsw.shop",nocase; classtype:attempted-recon; sid:200003680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signmaxxgh.com",nocase; classtype:attempted-recon; sid:200003681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siida-disperindag.kalbarprov.go.id",nocase; classtype:attempted-recon; sid:200003682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simamam.co.vu",nocase; classtype:attempted-recon; sid:200003683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simpeg.kalbarprov.go.id",nocase; classtype:attempted-recon; sid:200003684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simular.credfaciljb.com.br",nocase; classtype:attempted-recon; sid:200003685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sindarspen.org.br",nocase; classtype:attempted-recon; sid:200003686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"singingholic.com",nocase; classtype:attempted-recon; sid:200003687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siporados15585.blogspot.com",nocase; classtype:attempted-recon; sid:200003688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirak.se",nocase; classtype:attempted-recon; sid:200003689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirmakulasingsd.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200003690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitaci.net",nocase; classtype:attempted-recon; sid:200003691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site-4403463-3995-6112.mystrikingly.com",nocase; classtype:attempted-recon; sid:200003692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423623.92.webydo.com",nocase; classtype:attempted-recon; sid:200003693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423773.92.webydo.com",nocase; classtype:attempted-recon; sid:200003694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9434107.92.webydo.com",nocase; classtype:attempted-recon; sid:200003695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9548676.92.webydo.com",nocase; classtype:attempted-recon; sid:200003696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9551459.92.webydo.com",nocase; classtype:attempted-recon; sid:200003697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9552191.92.webydo.com",nocase; classtype:attempted-recon; sid:200003698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9605282.92.webydo.com",nocase; classtype:attempted-recon; sid:200003699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder139828.dynadot.com",nocase; classtype:attempted-recon; sid:200003700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder149675.dynadot.com",nocase; classtype:attempted-recon; sid:200003701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siteconfirmationpagescommunityprivacypolicy.co.vu",nocase; classtype:attempted-recon; sid:200003702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-facebook-resmi21.webnode.com",nocase; classtype:attempted-recon; sid:200003703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-pemulihan-resmi0.webnode.com",nocase; classtype:attempted-recon; sid:200003704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skade.gg",nocase; classtype:attempted-recon; sid:200003705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinwallet.eu",nocase; classtype:attempted-recon; sid:200003706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinwallet.in.ua",nocase; classtype:attempted-recon; sid:200003707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sklepkody.pl",nocase; classtype:attempted-recon; sid:200003708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skradvanidance.business.site",nocase; classtype:attempted-recon; sid:200003709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skybttv.com",nocase; classtype:attempted-recon; sid:200003710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skygobank.com",nocase; classtype:attempted-recon; sid:200003711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavis-accountupdate.com",nocase; classtype:attempted-recon; sid:200003712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavis.company",nocase; classtype:attempted-recon; sid:200003713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavis.solutions",nocase; classtype:attempted-recon; sid:200003714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skymavisupport.com",nocase; classtype:attempted-recon; sid:200003715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slavamel.github.io",nocase; classtype:attempted-recon; sid:200003716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sleepmaskz.com",nocase; classtype:attempted-recon; sid:200003717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slickparties.com",nocase; classtype:attempted-recon; sid:200003718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slmkufeckf.jon-jensen.workers.dev",nocase; classtype:attempted-recon; sid:200003719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slowlinebag.jp",nocase; classtype:attempted-recon; sid:200003720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sm777.csb.app",nocase; classtype:attempted-recon; sid:200003721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"small-tooth-a6b5.888ae01263f6900531fcc79d131bf8191a901fa7.workers.dev",nocase; classtype:attempted-recon; sid:200003722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smart1wazedev.com",nocase; classtype:attempted-recon; sid:200003723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smarteconomy.rs",nocase; classtype:attempted-recon; sid:200003724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-csmbc-jp.shop",nocase; classtype:attempted-recon; sid:200003725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcbank.monster",nocase; classtype:attempted-recon; sid:200003726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcwodeqingguoshoujicojp.top",nocase; classtype:attempted-recon; sid:200003727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smeo.org.mx",nocase; classtype:attempted-recon; sid:200003728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smertehkzgdwe2.clickfunnels.com",nocase; classtype:attempted-recon; sid:200003729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smetracking.com",nocase; classtype:attempted-recon; sid:200003730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smgolamalif.github.io",nocase; classtype:attempted-recon; sid:200003731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smkkesehatanjember.sch.id",nocase; classtype:attempted-recon; sid:200003732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smmsvocal.yolasite.com",nocase; classtype:attempted-recon; sid:200003733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sms-shorter.com",nocase; classtype:attempted-recon; sid:200003734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smscaixanovo.blogspot.com",nocase; classtype:attempted-recon; sid:200003735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsenligne.myfreesites.net",nocase; classtype:attempted-recon; sid:200003736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsgateway01.duckdns.org",nocase; classtype:attempted-recon; sid:200003737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangephonemail.myfreesites.net",nocase; classtype:attempted-recon; sid:200003738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangesmsmessage.myfreesites.net",nocase; classtype:attempted-recon; sid:200003739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smss-mms.yolasite.com",nocase; classtype:attempted-recon; sid:200003740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsverificationmms.myfreesites.net",nocase; classtype:attempted-recon; sid:200003741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snapchat.accounts.com.es",nocase; classtype:attempted-recon; sid:200003742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snbc-cardrs-jkoiasd-com.d05202.top",nocase; classtype:attempted-recon; sid:200003743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snbc-cardrs-plaokdkd-com.alol.ltd",nocase; classtype:attempted-recon; sid:200003744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snbc-cardrs-yuahdhjd-com.trymeticore.co",nocase; classtype:attempted-recon; sid:200003745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snbc-cardrs-yuaiod-com.f04242.top",nocase; classtype:attempted-recon; sid:200003746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snbc-cardrs-zajjdkf-com.malls.group",nocase; classtype:attempted-recon; sid:200003747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sniter.widyakartika.ac.id",nocase; classtype:attempted-recon; sid:200003748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snnbc-cardrs-bbuao-com.virginia.xin",nocase; classtype:attempted-recon; sid:200003749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snrsystem.com",nocase; classtype:attempted-recon; sid:200003750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soaringskiesrentals.com",nocase; classtype:attempted-recon; sid:200003751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soci-molen.web.app",nocase; classtype:attempted-recon; sid:200003752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"socialact.page.link",nocase; classtype:attempted-recon; sid:200003753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"socialpinch.com",nocase; classtype:attempted-recon; sid:200003754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"socworkgu.odoo.com",nocase; classtype:attempted-recon; sid:200003755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sofe-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soft-cell-8148.updateloginprogram.workers.dev",nocase; classtype:attempted-recon; sid:200003757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soft-grass-1edd.acc-update.workers.dev",nocase; classtype:attempted-recon; sid:200003758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soft-shadow-fa4c.mywnewdhlupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200003759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"softlearn.mystrikingly.com",nocase; classtype:attempted-recon; sid:200003760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"software.verify-secure.info",nocase; classtype:attempted-recon; sid:200003761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sognointerno.com",nocase; classtype:attempted-recon; sid:200003762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sojase6280.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200003763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solanasol2.com",nocase; classtype:attempted-recon; sid:200003764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solarsouth.in",nocase; classtype:attempted-recon; sid:200003765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soldierofthecross.us",nocase; classtype:attempted-recon; sid:200003766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solicitarfirmaelectronica-sv.com",nocase; classtype:attempted-recon; sid:200003767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solitary-flower-7e0a.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200003768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solyanayakomnata.ru",nocase; classtype:attempted-recon; sid:200003769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sonersc.unskjh.xyz",nocase; classtype:attempted-recon; sid:200003770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sopac.org.py",nocase; classtype:attempted-recon; sid:200003771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soporte.select-op.com",nocase; classtype:attempted-recon; sid:200003772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soracoes.xyz",nocase; classtype:attempted-recon; sid:200003773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souaxwaoh.myfreesites.net",nocase; classtype:attempted-recon; sid:200003774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soubanri.com",nocase; classtype:attempted-recon; sid:200003775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soude-masi.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soufsont.blogspot.com",nocase; classtype:attempted-recon; sid:200003777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soumya252000.github.io",nocase; classtype:attempted-recon; sid:200003778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souravtech.com",nocase; classtype:attempted-recon; sid:200003779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southamerica-east1-hardy-magpie-334101.cloudfunctions.net",nocase; classtype:attempted-recon; sid:200003780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southamerica-east1-manifest-design-330523.cloudfunctions.net",nocase; classtype:attempted-recon; sid:200003781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southamerica-east1-my-project-90086352.cloudfunctions.net",nocase; classtype:attempted-recon; sid:200003782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southamerica-east1-noted-minutia-330211.cloudfunctions.net",nocase; classtype:attempted-recon; sid:200003783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southport-farm-holidays.co.uk",nocase; classtype:attempted-recon; sid:200003784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southtownwakepark.com",nocase; classtype:attempted-recon; sid:200003785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soysodimac.estudiarfacil.com",nocase; classtype:attempted-recon; sid:200003786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp477389.sitebeat.site",nocase; classtype:attempted-recon; sid:200003787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp701876.sitebeat.site",nocase; classtype:attempted-recon; sid:200003788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spark.shaheenwrites.com",nocase; classtype:attempted-recon; sid:200003789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-pushapp.de",nocase; classtype:attempted-recon; sid:200003790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-pushtan.de",nocase; classtype:attempted-recon; sid:200003791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-1129.de",nocase; classtype:attempted-recon; sid:200003792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-costumercare.de",nocase; classtype:attempted-recon; sid:200003793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-kundenbetreuung.de",nocase; classtype:attempted-recon; sid:200003794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-kundensicherheit.de",nocase; classtype:attempted-recon; sid:200003795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-sicherheitspanel.de",nocase; classtype:attempted-recon; sid:200003796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.de.internet-filiale.sbs",nocase; classtype:attempted-recon; sid:200003797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-kundensicherheit.de",nocase; classtype:attempted-recon; sid:200003798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-kundensupport.de",nocase; classtype:attempted-recon; sid:200003799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkling-leaf-edc6.reseltz101.workers.dev",nocase; classtype:attempted-recon; sid:200003800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparxinteriors.co.zw",nocase; classtype:attempted-recon; sid:200003801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spasellaservisi.com",nocase; classtype:attempted-recon; sid:200003802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectrumstorageaccess.yahoosites.com",nocase; classtype:attempted-recon; sid:200003803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spela.svenskaspel.se",nocase; classtype:attempted-recon; sid:200003804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spentamultimedia.com",nocase; classtype:attempted-recon; sid:200003805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spidertvapp.com",nocase; classtype:attempted-recon; sid:200003806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-anzeig-case-24.xyz",nocase; classtype:attempted-recon; sid:200003807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-kundensicherheit.de",nocase; classtype:attempted-recon; sid:200003808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-sicherheitswarnung.com",nocase; classtype:attempted-recon; sid:200003809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-tanverfahren.de",nocase; classtype:attempted-recon; sid:200003810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sport.protected-secur.workers.dev",nocase; classtype:attempted-recon; sid:200003811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportybetpremium.wapka.co",nocase; classtype:attempted-recon; sid:200003812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spring-pond-62c4.autocreative.workers.dev",nocase; classtype:attempted-recon; sid:200003813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spring-pond-62c4.autocreative.workers.dev#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200003814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spropes-auntmillies-com.slite.com",nocase; classtype:attempted-recon; sid:200003815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sprw.io",nocase; classtype:attempted-recon; sid:200003816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spyke2021.github.io",nocase; classtype:attempted-recon; sid:200003817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"square-sound-f5a5.jkaminski8792.workers.dev",nocase; classtype:attempted-recon; sid:200003818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squeeze-airwcmalznoun.com",nocase; classtype:attempted-recon; sid:200003819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squeeze-amieazoeon.co",nocase; classtype:attempted-recon; sid:200003820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srisritextiles.com",nocase; classtype:attempted-recon; sid:200003821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srvr-cloudmail-srvr5s5wd3.pages.dev",nocase; classtype:attempted-recon; sid:200003822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srvr-ssocloudmai-r656rtgfk.pages.dev",nocase; classtype:attempted-recon; sid:200003823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssl-cloud-r.s4-cloud980-0.workers.dev",nocase; classtype:attempted-recon; sid:200003824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sslweb.lohnhaerterei-link.de",nocase; classtype:attempted-recon; sid:200003825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vi.com",nocase; classtype:attempted-recon; sid:200003826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vn.com",nocase; classtype:attempted-recon; sid:200003827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena.com",nocase; classtype:attempted-recon; sid:200003828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sswebmail-4w5twsr.web.app",nocase; classtype:attempted-recon; sid:200003829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staging.eliteautomotive.com.au",nocase; classtype:attempted-recon; sid:200003830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stamparijabg.rs",nocase; classtype:attempted-recon; sid:200003831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stardirectingfr.projet-web.net",nocase; classtype:attempted-recon; sid:200003832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starforsure.com",nocase; classtype:attempted-recon; sid:200003833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stargiveaway.com",nocase; classtype:attempted-recon; sid:200003834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starliker.net",nocase; classtype:attempted-recon; sid:200003835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starmak.com.tr",nocase; classtype:attempted-recon; sid:200003836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starsoftheindustry.com",nocase; classtype:attempted-recon; sid:200003837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"startseite-verden.de",nocase; classtype:attempted-recon; sid:200003838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starttsboxfile.myfreesites.net",nocase; classtype:attempted-recon; sid:200003839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static-ak-fbcdn.atspace.com",nocase; classtype:attempted-recon; sid:200003840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static-promote.weebly.com",nocase; classtype:attempted-recon; sid:200003841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staywealthy.com",nocase; classtype:attempted-recon; sid:200003842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stclarechurch.net",nocase; classtype:attempted-recon; sid:200003843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamcommunityzii.top",nocase; classtype:attempted-recon; sid:200003844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamworkshop-cn.com",nocase; classtype:attempted-recon; sid:200003845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steannconnunity.com",nocase; classtype:attempted-recon; sid:200003846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steep-wind-ce24.josephdelgado3790.workers.dev",nocase; classtype:attempted-recon; sid:200003847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steqmcpmmynity.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemadden-sverige.com",nocase; classtype:attempted-recon; sid:200003849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenbutik.com",nocase; classtype:attempted-recon; sid:200003850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenserbia.com",nocase; classtype:attempted-recon; sid:200003851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenshoe.net",nocase; classtype:attempted-recon; sid:200003852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steven-coldwellbth9965.web.app",nocase; classtype:attempted-recon; sid:200003853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevencrews.com",nocase; classtype:attempted-recon; sid:200003854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stewarts-stupendous-project-ee8707.webflow.io",nocase; classtype:attempted-recon; sid:200003855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stfabmax.com",nocase; classtype:attempted-recon; sid:200003856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stgrp.ru",nocase; classtype:attempted-recon; sid:200003857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"still-math-4bfc.dhkupdatedlogin.workers.dev",nocase; classtype:attempted-recon; sid:200003858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"still-star-c948.updatelogaccountprogramedrfwerwrdhsjy.workers.dev",nocase; classtype:attempted-recon; sid:200003859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"still-water-f10f.khun-shaedlive.workers.dev",nocase; classtype:attempted-recon; sid:200003860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stimulus-claim.com",nocase; classtype:attempted-recon; sid:200003861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stjudes.in",nocase; classtype:attempted-recon; sid:200003862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; classtype:attempted-recon; sid:200003863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.yandexcloud.net",nocase; classtype:attempted-recon; sid:200003864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"store.prunescape.com.au",nocase; classtype:attempted-recon; sid:200003865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storenike365.top",nocase; classtype:attempted-recon; sid:200003866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"streambledon.com",nocase; classtype:attempted-recon; sid:200003867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stripperpolenyc.com",nocase; classtype:attempted-recon; sid:200003868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stylifehomedecors.com",nocase; classtype:attempted-recon; sid:200003869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"subesiz-vakifgold.xyz",nocase; classtype:attempted-recon; sid:200003870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"subqo.com",nocase; classtype:attempted-recon; sid:200003871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"successful.myvnc.com",nocase; classtype:attempted-recon; sid:200003872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"successgroup.org",nocase; classtype:attempted-recon; sid:200003873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"succvirtl.com",nocase; classtype:attempted-recon; sid:200003874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalpersona-stransaccionesbancolombia.com",nocase; classtype:attempted-recon; sid:200003875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursapersonastransacionebancolombiaccomn.small-business-solutions.biz",nocase; classtype:attempted-recon; sid:200003876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucuvirtcolba.com",nocase; classtype:attempted-recon; sid:200003877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sudaworks.com",nocase; classtype:attempted-recon; sid:200003878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suelunn.com",nocase; classtype:attempted-recon; sid:200003879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suivi-cod2823999023.com",nocase; classtype:attempted-recon; sid:200003880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suiviticket.co",nocase; classtype:attempted-recon; sid:200003881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultan-raza.github.io",nocase; classtype:attempted-recon; sid:200003882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200003883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200003884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suminetconfir.hostfree.pw",nocase; classtype:attempted-recon; sid:200003885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"summer-silence-b218.documents-wrangler.workers.dev",nocase; classtype:attempted-recon; sid:200003886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"summerdayzlawn.com",nocase; classtype:attempted-recon; sid:200003887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumpandtankcleaners.in",nocase; classtype:attempted-recon; sid:200003888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunbeltmembers.com",nocase; classtype:attempted-recon; sid:200003889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunge-ode.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunrechnungrefu12122.online",nocase; classtype:attempted-recon; sid:200003891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunshineteam.in",nocase; classtype:attempted-recon; sid:200003892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suntmobilebanking.com",nocase; classtype:attempted-recon; sid:200003893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sup-arae-id.com",nocase; classtype:attempted-recon; sid:200003894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"super-cell-69aa.s-hiestand.workers.dev",nocase; classtype:attempted-recon; sid:200003895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"super-dawn-3035.ddahluwalia.workers.dev",nocase; classtype:attempted-recon; sid:200003896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir12.blogspot.com",nocase; classtype:attempted-recon; sid:200003897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir2.blogspot.com",nocase; classtype:attempted-recon; sid:200003898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200003899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz3.blogspot.com",nocase; classtype:attempted-recon; sid:200003900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200003901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supermilhas.com",nocase; classtype:attempted-recon; sid:200003902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superschool.bytesolutions.tk",nocase; classtype:attempted-recon; sid:200003903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersubtle-electro.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportecxacesso2020.com",nocase; classtype:attempted-recon; sid:200003905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suppliers.bitshepherd.org",nocase; classtype:attempted-recon; sid:200003906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-amaz.ek120.cn",nocase; classtype:attempted-recon; sid:200003907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-amaz.hamaa.net",nocase; classtype:attempted-recon; sid:200003908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-axiewallet.com",nocase; classtype:attempted-recon; sid:200003909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-redelivery-parcel.com",nocase; classtype:attempted-recon; sid:200003910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-verify-mydevices.com",nocase; classtype:attempted-recon; sid:200003911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support.staticmeta.tk",nocase; classtype:attempted-recon; sid:200003912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supportmailbxo.creatorlink.net",nocase; classtype:attempted-recon; sid:200003913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suppoter.ns12-wistee.fr",nocase; classtype:attempted-recon; sid:200003914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sureningnam.com.np",nocase; classtype:attempted-recon; sid:200003915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"survey18-aws.toluna.com",nocase; classtype:attempted-recon; sid:200003916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sv.mikecrm.com",nocase; classtype:attempted-recon; sid:200003917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svelte-kdy6dk.stackblitz.io",nocase; classtype:attempted-recon; sid:200003918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svetikc.space",nocase; classtype:attempted-recon; sid:200003919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sviabcp.com",nocase; classtype:attempted-recon; sid:200003920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svri-my-mtb.com",nocase; classtype:attempted-recon; sid:200003921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svssol.com",nocase; classtype:attempted-recon; sid:200003922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swanholm.net",nocase; classtype:attempted-recon; sid:200003923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swannatural.com",nocase; classtype:attempted-recon; sid:200003924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swap.elena.finance",nocase; classtype:attempted-recon; sid:200003925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swappauto.staging.lcsolutions.it",nocase; classtype:attempted-recon; sid:200003926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swaraajsports.com",nocase; classtype:attempted-recon; sid:200003927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscom.myfreesites.net",nocase; classtype:attempted-recon; sid:200003928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swissibisbank.com",nocase; classtype:attempted-recon; sid:200003929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspostdelivery.gq",nocase; classtype:attempted-recon; sid:200003930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switchoff2sleep.com",nocase; classtype:attempted-recon; sid:200003931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sxoa-ifdxey.gq",nocase; classtype:attempted-recon; sid:200003932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sydneymutual-bank.com",nocase; classtype:attempted-recon; sid:200003933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synaxisreadymix.com",nocase; classtype:attempted-recon; sid:200003934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sync-securedwallets.com",nocase; classtype:attempted-recon; sid:200003935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syncwalletconnect.cloud",nocase; classtype:attempted-recon; sid:200003936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syr.us",nocase; classtype:attempted-recon; sid:200003937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"szybkapaczka-pl.pl",nocase; classtype:attempted-recon; sid:200003938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mails.total.direct-energie.com",nocase; classtype:attempted-recon; sid:200003939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t0nline0telekom-001-site1.btempurl.com",nocase; classtype:attempted-recon; sid:200003940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t78ujh.lercg06vjp.workers.dev",nocase; classtype:attempted-recon; sid:200003941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t9y.me",nocase; classtype:attempted-recon; sid:200003942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabaccheriadelborgo.net",nocase; classtype:attempted-recon; sid:200003943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tadriib.com",nocase; classtype:attempted-recon; sid:200003944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taher-mohamed-ahmed-saad.github.io",nocase; classtype:attempted-recon; sid:200003945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tanbo.main.jp",nocase; classtype:attempted-recon; sid:200003946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tandoorinights.pk",nocase; classtype:attempted-recon; sid:200003947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tangingmilliaries.xyz",nocase; classtype:attempted-recon; sid:200003948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tarik-fitness.com",nocase; classtype:attempted-recon; sid:200003949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tarmigohalusing.tarungdrajatsiokalama.com",nocase; classtype:attempted-recon; sid:200003950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tarompa.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tattvastudios.com",nocase; classtype:attempted-recon; sid:200003952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taxopus.com",nocase; classtype:attempted-recon; sid:200003953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taxserviceref.irsgov-verify.com",nocase; classtype:attempted-recon; sid:200003954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tb5688.live",nocase; classtype:attempted-recon; sid:200003955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tb915hdh89.mfs.gg",nocase; classtype:attempted-recon; sid:200003956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tby.eb-sites.com",nocase; classtype:attempted-recon; sid:200003957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcaconnect.ac-page.com",nocase; classtype:attempted-recon; sid:200003958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"td-app1wb.com",nocase; classtype:attempted-recon; sid:200003959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tdlp.mx",nocase; classtype:attempted-recon; sid:200003960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"team.the-shrubbery.co.uk",nocase; classtype:attempted-recon; sid:200003961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamgoogle125590.psee.ly",nocase; classtype:attempted-recon; sid:200003962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tebapit.com",nocase; classtype:attempted-recon; sid:200003963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tebmedia.ps",nocase; classtype:attempted-recon; sid:200003964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techdirectbh.com",nocase; classtype:attempted-recon; sid:200003965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"technerds.co.zw",nocase; classtype:attempted-recon; sid:200003966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecnominproductos.com",nocase; classtype:attempted-recon; sid:200003967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teekitstorage.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200003968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teknoloji-bireyselcepvakif.ml",nocase; classtype:attempted-recon; sid:200003969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telcom.pe",nocase; classtype:attempted-recon; sid:200003970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telecredutobcp.com",nocase; classtype:attempted-recon; sid:200003971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telegram-veb.ru",nocase; classtype:attempted-recon; sid:200003972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telegramsecurityhelp.ru",nocase; classtype:attempted-recon; sid:200003973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telexaempresa.com",nocase; classtype:attempted-recon; sid:200003974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tellmeliu.github.io",nocase; classtype:attempted-recon; sid:200003975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"temizlik.teodrus.com",nocase; classtype:attempted-recon; sid:200003976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tempatpinjamuang.co.id",nocase; classtype:attempted-recon; sid:200003977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"templat65sldh.myfreesites.net",nocase; classtype:attempted-recon; sid:200003978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"temporary-url.com",nocase; classtype:attempted-recon; sid:200003979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tenisclubemc.com.br",nocase; classtype:attempted-recon; sid:200003980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tentpegs.co.za",nocase; classtype:attempted-recon; sid:200003981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terpelsicumple.com",nocase; classtype:attempted-recon; sid:200003982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terra-station-extention.com",nocase; classtype:attempted-recon; sid:200003983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terygay.com",nocase; classtype:attempted-recon; sid:200003984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.adicoder.com",nocase; classtype:attempted-recon; sid:200003985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.bayoucitybadges.org",nocase; classtype:attempted-recon; sid:200003986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.dxbproductions.com",nocase; classtype:attempted-recon; sid:200003987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.mediaclock.com.au",nocase; classtype:attempted-recon; sid:200003988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.prunescape.com.au",nocase; classtype:attempted-recon; sid:200003989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.webclient4.de",nocase; classtype:attempted-recon; sid:200003990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teste.listafood.com.br",nocase; classtype:attempted-recon; sid:200003991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"texasfreedomrun.com",nocase; classtype:attempted-recon; sid:200003992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tfxhnbextyynfvhkadkfufitmhriyb.22web.org",nocase; classtype:attempted-recon; sid:200003993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tgpafasfsakkk.pages.dev",nocase; classtype:attempted-recon; sid:200003994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thaiste.com",nocase; classtype:attempted-recon; sid:200003995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theaceofspaeder.com",nocase; classtype:attempted-recon; sid:200003996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebeachleague.com",nocase; classtype:attempted-recon; sid:200003997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebuddhasdream.net",nocase; classtype:attempted-recon; sid:200003998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebusinessprofitsystem.com",nocase; classtype:attempted-recon; sid:200003999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thechillipicklecanteen.com",nocase; classtype:attempted-recon; sid:200004000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedecorindia.com",nocase; classtype:attempted-recon; sid:200004001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedom.kg",nocase; classtype:attempted-recon; sid:200004002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefocaltherapyfoundation.org",nocase; classtype:attempted-recon; sid:200004003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theironinnparlour.co.uk",nocase; classtype:attempted-recon; sid:200004004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thelittlebookofnetworkmarketing.com",nocase; classtype:attempted-recon; sid:200004005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theneontree.in",nocase; classtype:attempted-recon; sid:200004006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thepaperdesign.com",nocase; classtype:attempted-recon; sid:200004007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therodeffectbook.com",nocase; classtype:attempted-recon; sid:200004008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theroesers.com",nocase; classtype:attempted-recon; sid:200004009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thespiritualtransformation.com",nocase; classtype:attempted-recon; sid:200004010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theumashow.com",nocase; classtype:attempted-recon; sid:200004011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thevivid.co",nocase; classtype:attempted-recon; sid:200004012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thirtttyyy.tk",nocase; classtype:attempted-recon; sid:200004013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thomasdentalcentre.com",nocase; classtype:attempted-recon; sid:200004014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"three-retail-live.devicetradein.co.uk",nocase; classtype:attempted-recon; sid:200004015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tieganford.ca",nocase; classtype:attempted-recon; sid:200004016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tighi.creatorlink.net",nocase; classtype:attempted-recon; sid:200004017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tight-samiuboc.co",nocase; classtype:attempted-recon; sid:200004018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"timeenigma.com#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinavegaphotography.com",nocase; classtype:attempted-recon; sid:200004020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tini.to",nocase; classtype:attempted-recon; sid:200004021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinify.ir",nocase; classtype:attempted-recon; sid:200004022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tipografieonline.ro",nocase; classtype:attempted-recon; sid:200004023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tirozhjewelry.com",nocase; classtype:attempted-recon; sid:200004024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"titelinedrillingintl.yolasite.com",nocase; classtype:attempted-recon; sid:200004025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlatx.com",nocase; classtype:attempted-recon; sid:200004026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlcbcp.ru",nocase; classtype:attempted-recon; sid:200004027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlclbcp.com",nocase; classtype:attempted-recon; sid:200004028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlclbcp.link",nocase; classtype:attempted-recon; sid:200004029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tmphysio.de",nocase; classtype:attempted-recon; sid:200004030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to-ken.biz",nocase; classtype:attempted-recon; sid:200004031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to.to",nocase; classtype:attempted-recon; sid:200004032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toancaupumps.com",nocase; classtype:attempted-recon; sid:200004033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toanhoc247.edu.vn",nocase; classtype:attempted-recon; sid:200004034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toddler-town.com",nocase; classtype:attempted-recon; sid:200004035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"todosmecaenbien.cl",nocase; classtype:attempted-recon; sid:200004036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomherrmann430m28wz4gk8ys85rsue8-9b3185.ingress-erytho.easywp.com",nocase; classtype:attempted-recon; sid:200004037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomobriencarcompanies.com",nocase; classtype:attempted-recon; sid:200004038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomsupholsterycleaning.com.au",nocase; classtype:attempted-recon; sid:200004039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tongdaiviettelbienhoa.com",nocase; classtype:attempted-recon; sid:200004040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tooljerejin.airsite.co",nocase; classtype:attempted-recon; sid:200004041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top10songsnews.com",nocase; classtype:attempted-recon; sid:200004042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topskills.ru",nocase; classtype:attempted-recon; sid:200004043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"torccolborrachas.blogspot.com",nocase; classtype:attempted-recon; sid:200004044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"torrinwine.com",nocase; classtype:attempted-recon; sid:200004045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tow1.photoclub-ebroicien.fr",nocase; classtype:attempted-recon; sid:200004046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"towsrus.net",nocase; classtype:attempted-recon; sid:200004047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tpq74.codesandbox.io",nocase; classtype:attempted-recon; sid:200004048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trackinyournumberdhl.com",nocase; classtype:attempted-recon; sid:200004049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tracytoypoodleempire.com",nocase; classtype:attempted-recon; sid:200004050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trade.pancakesvvep.com",nocase; classtype:attempted-recon; sid:200004051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tradeswarehouse.com",nocase; classtype:attempted-recon; sid:200004052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tradeturismo.com.br",nocase; classtype:attempted-recon; sid:200004053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trail.tmr.asia",nocase; classtype:attempted-recon; sid:200004054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trainingprofits.com",nocase; classtype:attempted-recon; sid:200004055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tramitesmicit-lineapersonalbccr.com",nocase; classtype:attempted-recon; sid:200004056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trams.mot.go.th",nocase; classtype:attempted-recon; sid:200004057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferenciasinternacionales104.webnode.es",nocase; classtype:attempted-recon; sid:200004058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferpricing.firs.gov.ng",nocase; classtype:attempted-recon; sid:200004059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transpaylbc1.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tribunbalikpapan.com",nocase; classtype:attempted-recon; sid:200004061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tridayaelektrindo.com",nocase; classtype:attempted-recon; sid:200004062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triggermarketing.biz",nocase; classtype:attempted-recon; sid:200004063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"truckcalling.com",nocase; classtype:attempted-recon; sid:200004064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trucktrader.com.my",nocase; classtype:attempted-recon; sid:200004065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"truthmilesanimalhospital.com",nocase; classtype:attempted-recon; sid:200004066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ts.hust.edu.vn",nocase; classtype:attempted-recon; sid:200004067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsuzuki.co.id",nocase; classtype:attempted-recon; sid:200004068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tudosobretudo.blog.br",nocase; classtype:attempted-recon; sid:200004069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuijnenburg.nl",nocase; classtype:attempted-recon; sid:200004070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turboflightpros.com",nocase; classtype:attempted-recon; sid:200004071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twowayradioband.com",nocase; classtype:attempted-recon; sid:200004072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twowheelcool.com",nocase; classtype:attempted-recon; sid:200004073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tx.vc",nocase; classtype:attempted-recon; sid:200004074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"txwnmdsbqghviqxpglgzjrgbzv-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"typesmartlyocr.com",nocase; classtype:attempted-recon; sid:200004076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyrecentre.ru",nocase; classtype:attempted-recon; sid:200004077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyzwox.webwave.dev",nocase; classtype:attempted-recon; sid:200004078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u01.in",nocase; classtype:attempted-recon; sid:200004079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u08qv44zu5h.typeform.com",nocase; classtype:attempted-recon; sid:200004080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u1529317.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u1532697.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u18741649.ct.sendgrid.net",nocase; classtype:attempted-recon; sid:200004083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u5e75n5.cn",nocase; classtype:attempted-recon; sid:200004084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uaedxbost.ddns.net",nocase; classtype:attempted-recon; sid:200004085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ucbonline.com",nocase; classtype:attempted-recon; sid:200004086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uglcsonfonia.org",nocase; classtype:attempted-recon; sid:200004087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk-re3ll6.com",nocase; classtype:attempted-recon; sid:200004088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukabgroup.com",nocase; classtype:attempted-recon; sid:200004089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukcare.in",nocase; classtype:attempted-recon; sid:200004090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umbrellaclubla.com",nocase; classtype:attempted-recon; sid:200004091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umu.link",nocase; classtype:attempted-recon; sid:200004092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unam.myfreesites.net",nocase; classtype:attempted-recon; sid:200004093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"undefinedtrack.xyz",nocase; classtype:attempted-recon; sid:200004094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unfinished.serveftp.com",nocase; classtype:attempted-recon; sid:200004095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unhappy.ddnsking.com",nocase; classtype:attempted-recon; sid:200004096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uni0nbnkoffphsavign.serveuser.com",nocase; classtype:attempted-recon; sid:200004097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unicreditaustria.ucs.info",nocase; classtype:attempted-recon; sid:200004098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unifacema.edu.br",nocase; classtype:attempted-recon; sid:200004099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unimaisfm.com.br",nocase; classtype:attempted-recon; sid:200004100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unionheightsresidental.com",nocase; classtype:attempted-recon; sid:200004101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unisons.store",nocase; classtype:attempted-recon; sid:200004102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unisonsouthayr.org.uk",nocase; classtype:attempted-recon; sid:200004103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.ch",nocase; classtype:attempted-recon; sid:200004104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.openwallet.dev",nocase; classtype:attempted-recon; sid:200004105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.pages.dev",nocase; classtype:attempted-recon; sid:200004106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.seal.finance",nocase; classtype:attempted-recon; sid:200004107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.token.im",nocase; classtype:attempted-recon; sid:200004108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.trading",nocase; classtype:attempted-recon; sid:200004109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.vn",nocase; classtype:attempted-recon; sid:200004110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswapfinancing.info",nocase; classtype:attempted-recon; sid:200004111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitib.com",nocase; classtype:attempted-recon; sid:200004112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"universidadsanjuan.ac",nocase; classtype:attempted-recon; sid:200004113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlimited-now.duckdns.org",nocase; classtype:attempted-recon; sid:200004114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlimitedmiracles.com",nocase; classtype:attempted-recon; sid:200004115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlswap-coin.com",nocase; classtype:attempted-recon; sid:200004116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unpocodearte.cl",nocase; classtype:attempted-recon; sid:200004117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregister-device-seclloyd.com",nocase; classtype:attempted-recon; sid:200004118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregpayee-lb.com",nocase; classtype:attempted-recon; sid:200004119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unsub.listhandlr.com",nocase; classtype:attempted-recon; sid:200004120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unworthy.servehttp.com",nocase; classtype:attempted-recon; sid:200004121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unwritten.xztart.cn",nocase; classtype:attempted-recon; sid:200004122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unxdin.nongresn.xyz",nocase; classtype:attempted-recon; sid:200004123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uoijk.cerzugesta.workers.dev",nocase; classtype:attempted-recon; sid:200004124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-cyxhjas23qjhk.de",nocase; classtype:attempted-recon; sid:200004125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updateinfo-billingo2.com",nocase; classtype:attempted-recon; sid:200004126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatelitmitedfiles.sgp1.digitaloceanspaces.com",nocase; classtype:attempted-recon; sid:200004127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updateseason.com",nocase; classtype:attempted-recon; sid:200004128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatevoda-billing.com",nocase; classtype:attempted-recon; sid:200004129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgrade-25gb-email.thecornerstudio.com.au",nocase; classtype:attempted-recon; sid:200004130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgradeyouryahoomailwewe.weebly.com",nocase; classtype:attempted-recon; sid:200004131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uploads.codesandbox.io",nocase; classtype:attempted-recon; sid:200004132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uppersecure.almazayaqa.com",nocase; classtype:attempted-recon; sid:200004133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upszerip.click",nocase; classtype:attempted-recon; sid:200004134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbenorte.com",nocase; classtype:attempted-recon; sid:200004135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urgent-halifaxlogin.com",nocase; classtype:attempted-recon; sid:200004136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlng.com",nocase; classtype:attempted-recon; sid:200004137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlth.me",nocase; classtype:attempted-recon; sid:200004138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urusartuyu.byethost7.com",nocase; classtype:attempted-recon; sid:200004139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us-trinity.net",nocase; classtype:attempted-recon; sid:200004140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usd-metamask.io",nocase; classtype:attempted-recon; sid:200004141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"userboitevocalweb.flazio.com",nocase; classtype:attempted-recon; sid:200004142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usfn.net",nocase; classtype:attempted-recon; sid:200004143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uswowgame.net",nocase; classtype:attempted-recon; sid:200004144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"utka.su",nocase; classtype:attempted-recon; sid:200004145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"utsahengineering.com",nocase; classtype:attempted-recon; sid:200004146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuhhgdjdh.ml",nocase; classtype:attempted-recon; sid:200004147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuid-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200004148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uyjg.nosep39216.workers.dev",nocase; classtype:attempted-recon; sid:200004149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v7zrh.codesandbox.io",nocase; classtype:attempted-recon; sid:200004150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifcilarhepberaber.com",nocase; classtype:attempted-recon; sid:200004151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifkampanyagirisi.tk",nocase; classtype:attempted-recon; sid:200004152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valenciaoptometry.com",nocase; classtype:attempted-recon; sid:200004153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valenteplay.com.br",nocase; classtype:attempted-recon; sid:200004154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valetecagricola.com.br",nocase; classtype:attempted-recon; sid:200004155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validacionpichincha.odoo.com",nocase; classtype:attempted-recon; sid:200004156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validationsystem.creatorlink.net",nocase; classtype:attempted-recon; sid:200004157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validator-fzkiy.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200004158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valmayqatar.com",nocase; classtype:attempted-recon; sid:200004159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"value.ddnsking.com",nocase; classtype:attempted-recon; sid:200004160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaoas.cc",nocase; classtype:attempted-recon; sid:200004161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"varagianna.com",nocase; classtype:attempted-recon; sid:200004162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vardhishnuagro.in",nocase; classtype:attempted-recon; sid:200004163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"varlakebuts.com",nocase; classtype:attempted-recon; sid:200004164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vc42ewypf1.li1ba2t1mnkddlqbeplxcoswecan.com",nocase; classtype:attempted-recon; sid:200004165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vcpjo.weblium.site",nocase; classtype:attempted-recon; sid:200004166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vectorad.it",nocase; classtype:attempted-recon; sid:200004167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvish.com",nocase; classtype:attempted-recon; sid:200004168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verbrindes.com.br",nocase; classtype:attempted-recon; sid:200004169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verfolgungdiepost.site44.com",nocase; classtype:attempted-recon; sid:200004170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verge.servehalflife.com",nocase; classtype:attempted-recon; sid:200004171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifca.in",nocase; classtype:attempted-recon; sid:200004172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verification.page.home.support.app-netflix.com.mavhcodigital.com",nocase; classtype:attempted-recon; sid:200004173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificationmessage.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200004174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-anda0011.weeblysite.com",nocase; classtype:attempted-recon; sid:200004175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-facebook0022.weeblysite.com",nocase; classtype:attempted-recon; sid:200004176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifiyedbluetickfeedback.ml",nocase; classtype:attempted-recon; sid:200004177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify-online-mtbnking.duckdns.org",nocase; classtype:attempted-recon; sid:200004178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.chase.billing.info.igualdad.cl",nocase; classtype:attempted-recon; sid:200004179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.xexodus.com",nocase; classtype:attempted-recon; sid:200004180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verikasi-account2021.weebly.com",nocase; classtype:attempted-recon; sid:200004181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"versement-fond.action-pass-acces-tts-lbc.eu",nocase; classtype:attempted-recon; sid:200004182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"versement-fond.secu-lbcoin-pass.com",nocase; classtype:attempted-recon; sid:200004183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"veryleboncoin.ru",nocase; classtype:attempted-recon; sid:200004184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahis211.blogspot.com",nocase; classtype:attempted-recon; sid:200004185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisbet.blogspot.com",nocase; classtype:attempted-recon; sid:200004186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgirissite.blogspot.com",nocase; classtype:attempted-recon; sid:200004187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgunceladres.blogspot.com",nocase; classtype:attempted-recon; sid:200004188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisimgir.blogspot.com",nocase; classtype:attempted-recon; sid:200004189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss.blogspot.com",nocase; classtype:attempted-recon; sid:200004190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200004191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissgir.blogspot.com",nocase; classtype:attempted-recon; sid:200004192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200004193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahsgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200004194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevoobahis.blogspot.com",nocase; classtype:attempted-recon; sid:200004195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vfefewssfe.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vgiuhkjnm.b9u6vh5l7g1797.workers.dev",nocase; classtype:attempted-recon; sid:200004197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp.com.pe-fuerza.com",nocase; classtype:attempted-recon; sid:200004198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"victorarath99.github.io",nocase; classtype:attempted-recon; sid:200004199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"videobigo.com",nocase; classtype:attempted-recon; sid:200004200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vietschi.de",nocase; classtype:attempted-recon; sid:200004201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200004202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viiabcpperu.com",nocase; classtype:attempted-recon; sid:200004203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vilanovacenter.com",nocase; classtype:attempted-recon; sid:200004204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"villagepizzavegan.co.uk",nocase; classtype:attempted-recon; sid:200004205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vimineous-carbureto.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinbpcfatfnkjftetwwkucfqsi-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinivet.mk",nocase; classtype:attempted-recon; sid:200004208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinted.pl-order.fun",nocase; classtype:attempted-recon; sid:200004209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"violatenotificationsalert.co.vu",nocase; classtype:attempted-recon; sid:200004210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vipfbtools.com",nocase; classtype:attempted-recon; sid:200004211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viralvidio.duckdns.org",nocase; classtype:attempted-recon; sid:200004212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virii-my-mtb.com",nocase; classtype:attempted-recon; sid:200004213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virtual1dattss.com",nocase; classtype:attempted-recon; sid:200004214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vis-stort.github.io",nocase; classtype:attempted-recon; sid:200004215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visa.com-vmore-1692065599.imagelinetech.com",nocase; classtype:attempted-recon; sid:200004216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visa.com-vmore-4636967280.imagelinetech.com",nocase; classtype:attempted-recon; sid:200004217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visione.co.id",nocase; classtype:attempted-recon; sid:200004218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visioninfo.be",nocase; classtype:attempted-recon; sid:200004219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visionproperty.in",nocase; classtype:attempted-recon; sid:200004220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vistasigns.com.mx",nocase; classtype:attempted-recon; sid:200004221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vitaage.com",nocase; classtype:attempted-recon; sid:200004222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-online-news.ru",nocase; classtype:attempted-recon; sid:200004223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-vhods.co",nocase; classtype:attempted-recon; sid:200004224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vkbj.yirzesurti.workers.dev",nocase; classtype:attempted-recon; sid:200004225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vkjbm.4nt4nb464e6113.workers.dev",nocase; classtype:attempted-recon; sid:200004226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vklogingroup.net.ru",nocase; classtype:attempted-recon; sid:200004227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vlabecepevalidarperu.com",nocase; classtype:attempted-recon; sid:200004228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voabcp.com",nocase; classtype:attempted-recon; sid:200004229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocal-esp.yolasite.com",nocase; classtype:attempted-recon; sid:200004230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocalcoachingbysloane.com",nocase; classtype:attempted-recon; sid:200004231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafone.bill1820.com",nocase; classtype:attempted-recon; sid:200004232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; classtype:attempted-recon; sid:200004233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodaupdatepayment.com",nocase; classtype:attempted-recon; sid:200004234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voed.ru",nocase; classtype:attempted-recon; sid:200004235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voice-note-received.sgp1.digitaloceanspaces.com",nocase; classtype:attempted-recon; sid:200004236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voicebymargo.com",nocase; classtype:attempted-recon; sid:200004237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"volvocarskc.us1.list-manage.com",nocase; classtype:attempted-recon; sid:200004238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpas-cadrjon.nars8fs.cn",nocase; classtype:attempted-recon; sid:200004239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpass-vjacardlongin.pqj22m3.cn",nocase; classtype:attempted-recon; sid:200004240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpasss-ne-inbex.hyrq6j.cn",nocase; classtype:attempted-recon; sid:200004241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpasss-ne-inbex.u34york7.cn",nocase; classtype:attempted-recon; sid:200004242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vps41123.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqed.5xcv81zrx0530.workers.dev",nocase; classtype:attempted-recon; sid:200004244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqwd.soboja1994.workers.dev",nocase; classtype:attempted-recon; sid:200004245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqws.zotratorte.workers.dev",nocase; classtype:attempted-recon; sid:200004246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqwv.hovoyef278.workers.dev",nocase; classtype:attempted-recon; sid:200004247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vt3pa0.webwave.dev",nocase; classtype:attempted-recon; sid:200004248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtekllc.com",nocase; classtype:attempted-recon; sid:200004249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtxmail2018.myfreesites.net",nocase; classtype:attempted-recon; sid:200004250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vuci.com",nocase; classtype:attempted-recon; sid:200004251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vugik.mecil33784.workers.dev",nocase; classtype:attempted-recon; sid:200004252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vugik.vomaliv389.workers.dev",nocase; classtype:attempted-recon; sid:200004253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvvvw-metam.top",nocase; classtype:attempted-recon; sid:200004254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvvvw-metamas.top",nocase; classtype:attempted-recon; sid:200004255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvvwwmetams.top",nocase; classtype:attempted-recon; sid:200004256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvwwmeta.top",nocase; classtype:attempted-recon; sid:200004257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vw.vbew.workers.dev",nocase; classtype:attempted-recon; sid:200004258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vxdse.myfreesites.net",nocase; classtype:attempted-recon; sid:200004259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vyixwx.webwave.dev",nocase; classtype:attempted-recon; sid:200004260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vypvracha.ru",nocase; classtype:attempted-recon; sid:200004261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w2.deraya.org",nocase; classtype:attempted-recon; sid:200004262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w5aproject.s3.us-east.cloud-object-storage.appdomain.cloud",nocase; classtype:attempted-recon; sid:200004263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w5czf.csb.app",nocase; classtype:attempted-recon; sid:200004264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w6634s.webwave.dev",nocase; classtype:attempted-recon; sid:200004265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wahed-koudsi2001.github.io",nocase; classtype:attempted-recon; sid:200004266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waisterase.com",nocase; classtype:attempted-recon; sid:200004267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walkers-dot-composite-store-326315.uk.r.appspot.com",nocase; classtype:attempted-recon; sid:200004268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walldesign.com.tr",nocase; classtype:attempted-recon; sid:200004269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallectconnect.co",nocase; classtype:attempted-recon; sid:200004270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-connect012.web.app",nocase; classtype:attempted-recon; sid:200004271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-mymanero.com",nocase; classtype:attempted-recon; sid:200004272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-reconnection.xyz",nocase; classtype:attempted-recon; sid:200004273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet.mymonero.ru",nocase; classtype:attempted-recon; sid:200004274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet.silesiacoin.com",nocase; classtype:attempted-recon; sid:200004275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletauthorisation.com",nocase; classtype:attempted-recon; sid:200004276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnectaid.net",nocase; classtype:attempted-recon; sid:200004277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnectdapps.in",nocase; classtype:attempted-recon; sid:200004278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnectee.com",nocase; classtype:attempted-recon; sid:200004279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnecttvlive.net",nocase; classtype:attempted-recon; sid:200004280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletconnectverifier.com",nocase; classtype:attempted-recon; sid:200004281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletfixconnect.info",nocase; classtype:attempted-recon; sid:200004282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsconnex.com",nocase; classtype:attempted-recon; sid:200004283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletvalidatorgroup.com",nocase; classtype:attempted-recon; sid:200004284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletvalidators.com",nocase; classtype:attempted-recon; sid:200004285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallletsconnects.net",nocase; classtype:attempted-recon; sid:200004286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallpapershedgehong.onrender.com",nocase; classtype:attempted-recon; sid:200004287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wana78420.myfreesites.net",nocase; classtype:attempted-recon; sid:200004288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wanchengtextile.com",nocase; classtype:attempted-recon; sid:200004289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wandering-scene-82d4.braveheartbull.workers.dev",nocase; classtype:attempted-recon; sid:200004290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitffybtcer.club",nocase; classtype:attempted-recon; sid:200004291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitffybtcer.xyz",nocase; classtype:attempted-recon; sid:200004292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitflyer.plus",nocase; classtype:attempted-recon; sid:200004293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.bitflyer.venus.kim",nocase; classtype:attempted-recon; sid:200004294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wap.btcffybtcer.com",nocase; classtype:attempted-recon; sid:200004295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warningshadows.org",nocase; classtype:attempted-recon; sid:200004296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warpingmachine.net",nocase; classtype:attempted-recon; sid:200004297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warsa.bandungkab.go.id",nocase; classtype:attempted-recon; sid:200004298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"washingmachineworks.in",nocase; classtype:attempted-recon; sid:200004299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watan99.com",nocase; classtype:attempted-recon; sid:200004300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"we-exodus-wallet.yahoosites.com",nocase; classtype:attempted-recon; sid:200004301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-armas.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200004302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-b4119.web.app",nocase; classtype:attempted-recon; sid:200004303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-e1f6d.web.app",nocase; classtype:attempted-recon; sid:200004304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-exodus.ru",nocase; classtype:attempted-recon; sid:200004305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-exoduss.com",nocase; classtype:attempted-recon; sid:200004306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-ml01.web.app",nocase; classtype:attempted-recon; sid:200004307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-segurooi.sytes.net",nocase; classtype:attempted-recon; sid:200004308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.bredbanque.trans.sylog.co",nocase; classtype:attempted-recon; sid:200004309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200004310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.sesao8.go.th",nocase; classtype:attempted-recon; sid:200004311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbbb.yolasite.com",nocase; classtype:attempted-recon; sid:200004312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbl.yolasite.com",nocase; classtype:attempted-recon; sid:200004313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdatamltrainingdiag842.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200004314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdisk.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200004315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webhost.cloudco.co.za",nocase; classtype:attempted-recon; sid:200004316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webip.yolasite.com",nocase; classtype:attempted-recon; sid:200004317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-2aaa0.web.app",nocase; classtype:attempted-recon; sid:200004318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-ajuda-expresso.brazilsouth.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200004319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-sso8uyg.web.app",nocase; classtype:attempted-recon; sid:200004320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.gourmer.co.in",nocase; classtype:attempted-recon; sid:200004321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.michanchito.cl",nocase; classtype:attempted-recon; sid:200004322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.njea.org",nocase; classtype:attempted-recon; sid:200004323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.riochepa.cl",nocase; classtype:attempted-recon; sid:200004324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmailadmin0.myfreesites.net",nocase; classtype:attempted-recon; sid:200004325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmailhosting.brazilsouth.cloudapp.azure.com",nocase; classtype:attempted-recon; sid:200004326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webproj.com",nocase; classtype:attempted-recon; sid:200004327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webpromerica.webcindario.com",nocase; classtype:attempted-recon; sid:200004328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webregular.xyz",nocase; classtype:attempted-recon; sid:200004329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"website--355347865560300265249-bank.business.site",nocase; classtype:attempted-recon; sid:200004330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitefun.club",nocase; classtype:attempted-recon; sid:200004331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webstories.eu",nocase; classtype:attempted-recon; sid:200004332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weeb-de.com",nocase; classtype:attempted-recon; sid:200004333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wegamingproesports.com",nocase; classtype:attempted-recon; sid:200004334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"well-42d74.web.app",nocase; classtype:attempted-recon; sid:200004335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wesedroy-com.preview-domain.com",nocase; classtype:attempted-recon; sid:200004336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weteachbh.com",nocase; classtype:attempted-recon; sid:200004337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wetransfer-view-documentonline.yolasite.com",nocase; classtype:attempted-recon; sid:200004338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whaleclassic.com",nocase; classtype:attempted-recon; sid:200004339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whare.100webspace.net",nocase; classtype:attempted-recon; sid:200004340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapgrubbokep99.duckdns.org",nocase; classtype:attempted-recon; sid:200004341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-18.ikwb.com",nocase; classtype:attempted-recon; sid:200004342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-clone-teamwork.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp18girl.4pu.com",nocase; classtype:attempted-recon; sid:200004344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.instanthq.com",nocase; classtype:attempted-recon; sid:200004345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.mrslove.com",nocase; classtype:attempted-recon; sid:200004346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whattsapps.misecure.com",nocase; classtype:attempted-recon; sid:200004347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wheelsofmercy.org",nocase; classtype:attempted-recon; sid:200004348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitelist-network.com",nocase; classtype:attempted-recon; sid:200004349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whyted.com",nocase; classtype:attempted-recon; sid:200004350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"widadkamillah.github.io",nocase; classtype:attempted-recon; sid:200004351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"willcardchange.hostingamazoncardin.xyz",nocase; classtype:attempted-recon; sid:200004352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"willtoaccssnowand.cf",nocase; classtype:attempted-recon; sid:200004353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"win-000-b-t-here.web.app",nocase; classtype:attempted-recon; sid:200004354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"windstream-net.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winkwink-tr.com",nocase; classtype:attempted-recon; sid:200004356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winter-poetry-35e7.andoni-zagouris.workers.dev",nocase; classtype:attempted-recon; sid:200004357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winville.biz",nocase; classtype:attempted-recon; sid:200004358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wireconfirmation68c10a25442a3e13.blogspot.com",nocase; classtype:attempted-recon; sid:200004359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wires-business-starter.webflow.io",nocase; classtype:attempted-recon; sid:200004360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wirtschaft.baesweiler.de",nocase; classtype:attempted-recon; sid:200004361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wisconsin-dmv-mv3001.com",nocase; classtype:attempted-recon; sid:200004362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wispy-wave-b764.andoni-zagouris.workers.dev",nocase; classtype:attempted-recon; sid:200004363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wizmi.service-now.com",nocase; classtype:attempted-recon; sid:200004364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wkazisan.github.io",nocase; classtype:attempted-recon; sid:200004365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wm2.cefassinaturacadastro.com",nocase; classtype:attempted-recon; sid:200004366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"womancreatorofman.com",nocase; classtype:attempted-recon; sid:200004367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wonderful.gr",nocase; classtype:attempted-recon; sid:200004368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woocommerce-704871-2333750.cloudwaysapps.com",nocase; classtype:attempted-recon; sid:200004369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woofle.ru",nocase; classtype:attempted-recon; sid:200004370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woomcenter.com",nocase; classtype:attempted-recon; sid:200004371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workforcerelief.com",nocase; classtype:attempted-recon; sid:200004372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workprotocoles-com.webs.com",nocase; classtype:attempted-recon; sid:200004373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wouovaspss.pw",nocase; classtype:attempted-recon; sid:200004374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wowcake.finance",nocase; classtype:attempted-recon; sid:200004375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp-login.azurewebsites.net",nocase; classtype:attempted-recon; sid:200004376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp1.monovm.com",nocase; classtype:attempted-recon; sid:200004377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wpsoar.com",nocase; classtype:attempted-recon; sid:200004378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.chobqu.cn",nocase; classtype:attempted-recon; sid:200004379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.dccigq.cn",nocase; classtype:attempted-recon; sid:200004380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.gbswz.cn",nocase; classtype:attempted-recon; sid:200004381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.jeewiki.cn",nocase; classtype:attempted-recon; sid:200004382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.pygbw.cn",nocase; classtype:attempted-recon; sid:200004383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqdqnna.ga",nocase; classtype:attempted-recon; sid:200004384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wrap.co",nocase; classtype:attempted-recon; sid:200004385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wsfvbv456yujhgr-7654rgfd-9a4077.ingress-baronn.easywp.com",nocase; classtype:attempted-recon; sid:200004386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wsxwaaaa.web.app",nocase; classtype:attempted-recon; sid:200004387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wtf-seff.duckdns.org",nocase; classtype:attempted-recon; sid:200004388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wulalalela.cyou",nocase; classtype:attempted-recon; sid:200004389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvwroninwallet.top",nocase; classtype:attempted-recon; sid:200004390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww.interbak.personas.operaciones.en.linea.primedeals.pk",nocase; classtype:attempted-recon; sid:200004391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww.viabpc.com",nocase; classtype:attempted-recon; sid:200004392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-cursosdigitalesmx-com.filesusr.com",nocase; classtype:attempted-recon; sid:200004393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-degelyehuda-org-il.filesusr.com",nocase; classtype:attempted-recon; sid:200004394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200004395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europessign-com.filesusr.com",nocase; classtype:attempted-recon; sid:200004396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-key-com.test.edgekey.net",nocase; classtype:attempted-recon; sid:200004397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.webmail.assembly.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200004398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.avylifzbhu.cn",nocase; classtype:attempted-recon; sid:200004399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.fcihytdabj.cn",nocase; classtype:attempted-recon; sid:200004400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.huclsptqxa.cn",nocase; classtype:attempted-recon; sid:200004401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.lsopxabgmr.cn",nocase; classtype:attempted-recon; sid:200004402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.mlcjsfykzi.cn",nocase; classtype:attempted-recon; sid:200004403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.nefolsivjd.cn",nocase; classtype:attempted-recon; sid:200004404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.nwbybvo.cn",nocase; classtype:attempted-recon; sid:200004405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.vndqjylikz.cn",nocase; classtype:attempted-recon; sid:200004406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.wbsoeag.cn",nocase; classtype:attempted-recon; sid:200004407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.wisqfxpvjz.cn",nocase; classtype:attempted-recon; sid:200004408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.xgralvcijo.cn",nocase; classtype:attempted-recon; sid:200004409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.amaozom.xuwtijrkop.cn",nocase; classtype:attempted-recon; sid:200004410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.mercarl.login1.0v42swj.cn",nocase; classtype:attempted-recon; sid:200004411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www1.mercarl.login1.c9kq60.cn",nocase; classtype:attempted-recon; sid:200004412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.aeke.cn",nocase; classtype:attempted-recon; sid:200004413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.demintang.cn",nocase; classtype:attempted-recon; sid:200004414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.ducy.cn",nocase; classtype:attempted-recon; sid:200004415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.hesifang.cn",nocase; classtype:attempted-recon; sid:200004416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.heyunde.cn",nocase; classtype:attempted-recon; sid:200004417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.jiliyong.cn",nocase; classtype:attempted-recon; sid:200004418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.jiop.cn",nocase; classtype:attempted-recon; sid:200004419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.kudayin.cn",nocase; classtype:attempted-recon; sid:200004420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.rui2.cn",nocase; classtype:attempted-recon; sid:200004421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.weimila.cn",nocase; classtype:attempted-recon; sid:200004422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.youjinmei.cn",nocase; classtype:attempted-recon; sid:200004423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.zhaimin.cn",nocase; classtype:attempted-recon; sid:200004424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.amaozom.zhaochaya.cn",nocase; classtype:attempted-recon; sid:200004425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.etc-meilsaii.jp.yjhycf.xyz",nocase; classtype:attempted-recon; sid:200004426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.mercarl.login2.b0axzb.cn",nocase; classtype:attempted-recon; sid:200004427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.mercarl.login2.iedrcr.cn",nocase; classtype:attempted-recon; sid:200004428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.mercarl.login2.lplz1p.cn",nocase; classtype:attempted-recon; sid:200004429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www2.smeil-etc-meisai.jpxc0da4cda2x6d8sa0.wutax.com",nocase; classtype:attempted-recon; sid:200004430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.colegiosantaangelamerici.edu.co",nocase; classtype:attempted-recon; sid:200004431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.lejournaldugrandparis.fr",nocase; classtype:attempted-recon; sid:200004432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.plenainclusion.org",nocase; classtype:attempted-recon; sid:200004433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www4.mercarl.login4.d8mjvz.cn",nocase; classtype:attempted-recon; sid:200004434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wwwpancakeswap.top",nocase; classtype:attempted-recon; sid:200004435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wwwsbcpbank.com",nocase; classtype:attempted-recon; sid:200004436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wypadki24.e-kei.pl",nocase; classtype:attempted-recon; sid:200004437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"x.rxciser.fr",nocase; classtype:attempted-recon; sid:200004438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xaydungtamhoanganh.com",nocase; classtype:attempted-recon; sid:200004439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xbtdangotexxbt.boxmode.io",nocase; classtype:attempted-recon; sid:200004440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xgyul.codesandbox.io",nocase; classtype:attempted-recon; sid:200004441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh13v.mjt.lu",nocase; classtype:attempted-recon; sid:200004442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh140.mjt.lu",nocase; classtype:attempted-recon; sid:200004443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh14n.mjt.lu",nocase; classtype:attempted-recon; sid:200004444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh156.mjt.lu",nocase; classtype:attempted-recon; sid:200004445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1ou.mjt.lu",nocase; classtype:attempted-recon; sid:200004446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1pl.mjt.lu",nocase; classtype:attempted-recon; sid:200004447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1u4.mjt.lu",nocase; classtype:attempted-recon; sid:200004448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlgt.mjt.lu",nocase; classtype:attempted-recon; sid:200004449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlr4.mjt.lu",nocase; classtype:attempted-recon; sid:200004450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlvl.mjt.lu",nocase; classtype:attempted-recon; sid:200004451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnq.mjt.lu",nocase; classtype:attempted-recon; sid:200004452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnu.mjt.lu",nocase; classtype:attempted-recon; sid:200004453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnv.mjt.lu",nocase; classtype:attempted-recon; sid:200004454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmqu.mjt.lu",nocase; classtype:attempted-recon; sid:200004455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhs02.mjt.lu",nocase; classtype:attempted-recon; sid:200004456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xid-human-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200004457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj333.mjt.lu",nocase; classtype:attempted-recon; sid:200004458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33s.mjt.lu",nocase; classtype:attempted-recon; sid:200004459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33w.mjt.lu",nocase; classtype:attempted-recon; sid:200004460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj3pr.mjt.lu",nocase; classtype:attempted-recon; sid:200004461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45g.mjt.lu",nocase; classtype:attempted-recon; sid:200004462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45o.mjt.lu",nocase; classtype:attempted-recon; sid:200004463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj4og.mjt.lu",nocase; classtype:attempted-recon; sid:200004464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjm7s.mjt.lu",nocase; classtype:attempted-recon; sid:200004465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjmr7.mjt.lu",nocase; classtype:attempted-recon; sid:200004466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xju3s.mjt.lu",nocase; classtype:attempted-recon; sid:200004467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjupr.mjt.lu",nocase; classtype:attempted-recon; sid:200004468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjzzvagpvwxetintwpbhahwmcgteab.22web.org",nocase; classtype:attempted-recon; sid:200004469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkdwm.csb.app",nocase; classtype:attempted-recon; sid:200004470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkljfg.ml",nocase; classtype:attempted-recon; sid:200004471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xmissionservre.weebly.com",nocase; classtype:attempted-recon; sid:200004472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xmley.codesandbox.io",nocase; classtype:attempted-recon; sid:200004473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--banriul-hpb.com",nocase; classtype:attempted-recon; sid:200004474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--gmal-sya.com",nocase; classtype:attempted-recon; sid:200004475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--intrbark-d1a.xn--empres-uta.com",nocase; classtype:attempted-recon; sid:200004476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--ltappen-80a.se",nocase; classtype:attempted-recon; sid:200004477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--metamsk-lwa.link",nocase; classtype:attempted-recon; sid:200004478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--mklerian-0za.se",nocase; classtype:attempted-recon; sid:200004479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pacincia-xl-qbb.com",nocase; classtype:attempted-recon; sid:200004480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--raydum-6va.com",nocase; classtype:attempted-recon; sid:200004481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--rpondeur-sfr2-bhb.yolasite.com",nocase; classtype:attempted-recon; sid:200004482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--rpondeur-vocal12-bqb.yolasite.com",nocase; classtype:attempted-recon; sid:200004483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3i.mjt.lu",nocase; classtype:attempted-recon; sid:200004484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3n.mjt.lu",nocase; classtype:attempted-recon; sid:200004485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3u.mjt.lu",nocase; classtype:attempted-recon; sid:200004486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrcieeyvtpkjgygewanuuzpbtwmtja.22web.org",nocase; classtype:attempted-recon; sid:200004487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrx6r.mjt.lu",nocase; classtype:attempted-recon; sid:200004488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh1.mjt.lu",nocase; classtype:attempted-recon; sid:200004489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh2.mjt.lu",nocase; classtype:attempted-recon; sid:200004490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxhl.mjt.lu",nocase; classtype:attempted-recon; sid:200004491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xsop5vp0rfd.typeform.com",nocase; classtype:attempted-recon; sid:200004492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtio.ch",nocase; classtype:attempted-recon; sid:200004493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtw42.mjt.lu",nocase; classtype:attempted-recon; sid:200004494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xxam.xyz",nocase; classtype:attempted-recon; sid:200004495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200004496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyf1.cn",nocase; classtype:attempted-recon; sid:200004497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyproject.xtensio.com",nocase; classtype:attempted-recon; sid:200004498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y38.org",nocase; classtype:attempted-recon; sid:200004499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y3s2ye.webwave.dev",nocase; classtype:attempted-recon; sid:200004500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yabo12app.cn",nocase; classtype:attempted-recon; sid:200004501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaboshi.com",nocase; classtype:attempted-recon; sid:200004502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoo-aq.com",nocase; classtype:attempted-recon; sid:200004503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoomailnetworkserver.weebly.com",nocase; classtype:attempted-recon; sid:200004504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoomailnewserviceprovider.weebly.com",nocase; classtype:attempted-recon; sid:200004505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahuomall.square.site",nocase; classtype:attempted-recon; sid:200004506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yairix.github.io",nocase; classtype:attempted-recon; sid:200004507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yalena.me",nocase; classtype:attempted-recon; sid:200004508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yamarcorangefr.ctcin.bio",nocase; classtype:attempted-recon; sid:200004509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaqoobi.org",nocase; classtype:attempted-recon; sid:200004510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yashomatithakur.in",nocase; classtype:attempted-recon; sid:200004511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yayanti.com",nocase; classtype:attempted-recon; sid:200004512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yayiblancomar.wixsite.com",nocase; classtype:attempted-recon; sid:200004513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ybs.51haoyayi.cn",nocase; classtype:attempted-recon; sid:200004514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yellow-surf-7b04.voiceovermade-today.workers.dev",nocase; classtype:attempted-recon; sid:200004515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yellow-violet-b3b4.lbaker.workers.dev",nocase; classtype:attempted-recon; sid:200004516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yfiugk.fisali67373975.workers.dev",nocase; classtype:attempted-recon; sid:200004517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ygq5uc.cn",nocase; classtype:attempted-recon; sid:200004518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yiaswqjdtcyeqpvyqthijepeai-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yjthrwef.sxoa-ifdxey.gq",nocase; classtype:attempted-recon; sid:200004520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ykyevmqxaktnfgrtuufymkhnce-dot-gl44393333333.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yogeshwarwiremesh.com",nocase; classtype:attempted-recon; sid:200004522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yoinkgp.xyz",nocase; classtype:attempted-recon; sid:200004523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yoplwg2740634.byethost17.com",nocase; classtype:attempted-recon; sid:200004524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youknowar.com",nocase; classtype:attempted-recon; sid:200004525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youknowar.social-preview.top",nocase; classtype:attempted-recon; sid:200004526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"young-fog-19ef.dhlupdatedblurnt.workers.dev",nocase; classtype:attempted-recon; sid:200004527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"young-snow-7447.tcheviron5269.workers.dev",nocase; classtype:attempted-recon; sid:200004528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youthtrend.in",nocase; classtype:attempted-recon; sid:200004529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youwillmoveme.com",nocase; classtype:attempted-recon; sid:200004530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youwingirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200004531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yreluar.rest",nocase; classtype:attempted-recon; sid:200004532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ysfzrrod.cc",nocase; classtype:attempted-recon; sid:200004533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yubababsks.webcindario.com",nocase; classtype:attempted-recon; sid:200004534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yuioptr.yolasite.com",nocase; classtype:attempted-recon; sid:200004535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yuuu6.codesandbox.io",nocase; classtype:attempted-recon; sid:200004536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvaledesoser.t.justns.ru",nocase; classtype:attempted-recon; sid:200004537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z0massegurabclp1.shreeramwoodindustries.com",nocase; classtype:attempted-recon; sid:200004538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z2qje.codesandbox.io",nocase; classtype:attempted-recon; sid:200004539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z3voicrxxvs.typeform.com",nocase; classtype:attempted-recon; sid:200004540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z965.cn",nocase; classtype:attempted-recon; sid:200004541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zackselectronics.co.zw",nocase; classtype:attempted-recon; sid:200004542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zaelogistics.com",nocase; classtype:attempted-recon; sid:200004543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zb2-home.web.app",nocase; classtype:attempted-recon; sid:200004544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zekkafreitas-vando-magazine.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200004545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zen-bose.46-101-250-180.plesk.page",nocase; classtype:attempted-recon; sid:200004546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zenritsusen-care.com",nocase; classtype:attempted-recon; sid:200004547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zepe.io",nocase; classtype:attempted-recon; sid:200004548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zeroquiz.com",nocase; classtype:attempted-recon; sid:200004549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zhguanshi.com",nocase; classtype:attempted-recon; sid:200004550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zi-3-gporange1.free.builderall.com",nocase; classtype:attempted-recon; sid:200004551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zimbabwe.net.za",nocase; classtype:attempted-recon; sid:200004552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zimbria.creatorlink.net",nocase; classtype:attempted-recon; sid:200004553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zjzj6688.yihang.ren",nocase; classtype:attempted-recon; sid:200004554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-online.web.app",nocase; classtype:attempted-recon; sid:200004555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-validationserv.web.app",nocase; classtype:attempted-recon; sid:200004556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zom-account.xyz",nocase; classtype:attempted-recon; sid:200004557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonefire.info",nocase; classtype:attempted-recon; sid:200004558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoovita.kz",nocase; classtype:attempted-recon; sid:200004559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zorten.com",nocase; classtype:attempted-recon; sid:200004560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0333fa5.netsolhost.com",nocase; http_uri; content:"/comcast/xfinity.php?d1193169ba22c33594765d16035661b1=&amp\;email=a@a.c&amp\;.rand=login.xfinity.com.aspx",nocase; classtype:attempted-recon; sid:200004561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/",nocase; classtype:attempted-recon; sid:200004562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/iframe-page2.html",nocase; classtype:attempted-recon; sid:200004563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"048d7b4.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login",nocase; classtype:attempted-recon; sid:200004564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"048d7b4.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/",nocase; classtype:attempted-recon; sid:200004565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0492d3a.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/vos-remboursements/portailas/",nocase; classtype:attempted-recon; sid:200004566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"108ideashop.com",nocase; http_uri; content:"/ads/c/",nocase; classtype:attempted-recon; sid:200004567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"10dovestreet.com",nocase; http_uri; content:"/resources/",nocase; classtype:attempted-recon; sid:200004568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5559915/microsoft-team",nocase; classtype:attempted-recon; sid:200004569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5578660/form",nocase; classtype:attempted-recon; sid:200004570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12hjeen9wd.preerbsaistkmrdzkkmjxmqsweerrygext.com",nocase; http_uri; content:"/rd/c507zighu1244882bblg22499hvl7387vciz181",nocase; classtype:attempted-recon; sid:200004571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.3.150.34.bc.googleusercontent.com",nocase; http_uri; content:"/confirmacao/",nocase; classtype:attempted-recon; sid:200004572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.3.150.34.bc.googleusercontent.com",nocase; http_uri; content:"/confirmacao/?hash= confirmacao caixa",nocase; classtype:attempted-recon; sid:200004573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.3.150.34.bc.googleusercontent.com",nocase; http_uri; content:"/confirmacao/?hash=%20confirmacao%20caixa",nocase; classtype:attempted-recon; sid:200004574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.15",nocase; http_uri; content:"/?id=http://www.cdph.ca.gov/programs/chcq/lcp/pages/afl-20-33.aspx&amp\;fields=og_object{engagement}&amp\;callback=_ate.cbs.rcb_fiqs0",nocase; classtype:attempted-recon; sid:200004575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200004576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.22.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200004577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!bbfkfubdzlmf4bxyznr20upuimi1?e=bcfamsa3qks2l7lvshve1a&amp\;at=9",nocase; classtype:attempted-recon; sid:200004578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!bdl5r1ki9tc3gqvi-1haort04ahz?e=2lalmxflvewx2tjousf09g&amp\;at=9",nocase; classtype:attempted-recon; sid:200004579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/w/s!at6abcmxoqeqgrrahazju3fo1ojj",nocase; classtype:attempted-recon; sid:200004580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"21jieyan.cn",nocase; http_uri; content:"/ke2mxbr0/supermaxi/?_t=1638806731476#1638806732858",nocase; classtype:attempted-recon; sid:200004581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"21jieyan.cn",nocase; http_uri; content:"/orweblwa/supermaxi/?_t=1638734847633#1638734849391",nocase; classtype:attempted-recon; sid:200004582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"226.95.224.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/appweb/desktop/v2/user/?auth=afbl0zlmzwwscx6rubwbuq9ykmnvonpqjlzwhmpquobtrv3ct5a8n7hgddcsnhuycexppbjniolkifzgo6ydt",nocase; classtype:attempted-recon; sid:200004583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"227.8.79.34.bc.googleusercontent.com",nocase; http_uri; content:"/lembrete",nocase; classtype:attempted-recon; sid:200004584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"227.8.79.34.bc.googleusercontent.com",nocase; http_uri; content:"/lembrete/",nocase; classtype:attempted-recon; sid:200004585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"28ecne20f9u.securetnet.com",nocase; http_uri; content:"/bbva/592cf4/425bdbd3-91cf-4e9f-9498-7a06b3ad75ec/?test=1",nocase; classtype:attempted-recon; sid:200004586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"377080202567359722137708020256735972.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200004587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3rdstreetmarket.com",nocase; http_uri; content:"/wp-content/themes/3rdst/8-login-form/",nocase; classtype:attempted-recon; sid:200004588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200004589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-q-f.com",nocase; http_uri; content:"/openpc/directlogin.do",nocase; classtype:attempted-recon; sid:200004590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acacia.webdevonline.net",nocase; http_uri; content:"/mail/countinautopage/index.php?email=dg@flexport.com",nocase; classtype:attempted-recon; sid:200004591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; http_uri; content:"/login",nocase; classtype:attempted-recon; sid:200004592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; http_uri; content:"/login/",nocase; classtype:attempted-recon; sid:200004593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; http_uri; content:"/login/authentication.html",nocase; classtype:attempted-recon; sid:200004594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; http_uri; content:"/login/twofactorauthentication.html",nocase; classtype:attempted-recon; sid:200004595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt",nocase; classtype:attempted-recon; sid:200004596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&amp\;passive=1209600&amp\;continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&amp\;followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200004597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html",nocase; classtype:attempted-recon; sid:200004598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html",nocase; classtype:attempted-recon; sid:200004599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200004600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html",nocase; classtype:attempted-recon; sid:200004601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm&followup=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm",nocase; classtype:attempted-recon; sid:200004602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html&followup=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html",nocase; classtype:attempted-recon; sid:200004603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200004604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/admin/support/inv/ver/app/index",nocase; classtype:attempted-recon; sid:200004605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/674f82e5abe83f264a9ed2fe302c5756/secureaccount.php?country.x=gb&amp\;locale.x=en_gb&amp\;customer.x=id-pa$1$anytl6pc$grtl1s/gj4jgysgla3yof1&amp\;safety=cz7je26a5ivycnle8c65dbqcbke0whmo31xtx0gzcd03ufwm5895a2eippbr33rs4e3bkohn20fyudq6a9vsj774tl0fg8/css/paypalsansbig-light.svg",nocase; classtype:attempted-recon; sid:200004606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/becc1dd370c40fc36d97ac749acceaa3/secureaccount.php?country.x=gb&amp\;locale.x=en_gb&amp\;customer.x=id-pa$1$57rbqkxx$vhibd4l3vr3tfnfffdrq/1&amp\;safety=pzv8t4dneidf8cc99spbcko3egb9xfjend513b402uoa2eiwacabam1rug7xm6k4y0w9f1dcqhfs111yhlaj7t0vrzl6q1/css/paypalsansbig-light.woff",nocase; classtype:attempted-recon; sid:200004607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; http_uri; content:"/v4/ajax/.check/becc1dd370c40fc36d97ac749acceaa3/secureaccount.php?country.x=gb&locale.x=en_gb&customer.x=id-pa$1$57rbqkxx$vhibd4l3vr3tfnfffdrq/1&safety=pzv8t4dneidf8cc99spbcko3egb9xfjend513b402uoa2eiwacabam1rug7xm6k4y0w9f1dcqhfs111yhlaj7t0vrzl6q1",nocase; classtype:attempted-recon; sid:200004608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agribisnis.faperta.ulm.ac.id",nocase; http_uri; content:"/task1/index.html",nocase; classtype:attempted-recon; sid:200004609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aijcs.blogspot.com",nocase; http_uri; content:"/2005/03/colourful-life-of-aij.html",nocase; classtype:attempted-recon; sid:200004610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alconexport.com",nocase; http_uri; content:"/ion",nocase; classtype:attempted-recon; sid:200004611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alconexport.com",nocase; http_uri; content:"/ion/",nocase; classtype:attempted-recon; sid:200004612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerttnow.com",nocase; http_uri; content:"/landing/form/7a82c14e-e2b3-4a69-9ee5-83c04ae82ad7",nocase; classtype:attempted-recon; sid:200004613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfredtalkelogisticservices-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/venus_gardose_talke_com/_layouts/15/wopiframe.aspx?guestaccesstoken=8extkunxrkqozifs2sycqmk4ox0ntao7cizsavm5mjc=&amp\;docid=1_14abcf62971634e6b8387df30ef7d978b&amp\;wdformid={83a6cfc0-5689-4aa4-ab13-96952b8999ba}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200004614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alinachopra.com",nocase; http_uri; content:"/blog/wp-content/themes/10/",nocase; classtype:attempted-recon; sid:200004615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/152ad",nocase; classtype:attempted-recon; sid:200004616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/1f7a2",nocase; classtype:attempted-recon; sid:200004617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/1f7a2/",nocase; classtype:attempted-recon; sid:200004618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/28485",nocase; classtype:attempted-recon; sid:200004619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/2ce3e/homepage",nocase; classtype:attempted-recon; sid:200004620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/3191a",nocase; classtype:attempted-recon; sid:200004621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/3abfa",nocase; classtype:attempted-recon; sid:200004622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/3abfa/",nocase; classtype:attempted-recon; sid:200004623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/3c0a0",nocase; classtype:attempted-recon; sid:200004624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/4604e",nocase; classtype:attempted-recon; sid:200004625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/4fe44",nocase; classtype:attempted-recon; sid:200004626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/4fe44/",nocase; classtype:attempted-recon; sid:200004627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/6e509",nocase; classtype:attempted-recon; sid:200004628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/6e509/",nocase; classtype:attempted-recon; sid:200004629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/6eedb",nocase; classtype:attempted-recon; sid:200004630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/7591a",nocase; classtype:attempted-recon; sid:200004631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/8afbb",nocase; classtype:attempted-recon; sid:200004632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/8afbb/",nocase; classtype:attempted-recon; sid:200004633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/9152f",nocase; classtype:attempted-recon; sid:200004634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/957c7",nocase; classtype:attempted-recon; sid:200004635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/a71f5",nocase; classtype:attempted-recon; sid:200004636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/a71f5/",nocase; classtype:attempted-recon; sid:200004637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/af0d2",nocase; classtype:attempted-recon; sid:200004638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/afe26",nocase; classtype:attempted-recon; sid:200004639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/b0e80",nocase; classtype:attempted-recon; sid:200004640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/c4647",nocase; classtype:attempted-recon; sid:200004641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/ce8af",nocase; classtype:attempted-recon; sid:200004642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/d3b03",nocase; classtype:attempted-recon; sid:200004643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/d3b03/",nocase; classtype:attempted-recon; sid:200004644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/d650b",nocase; classtype:attempted-recon; sid:200004645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/db91a",nocase; classtype:attempted-recon; sid:200004646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allkku.com",nocase; http_uri; content:"/mazon/dfb0c",nocase; classtype:attempted-recon; sid:200004647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allnewhaircut.com",nocase; http_uri; content:"/smi.cers/bmss.php",nocase; classtype:attempted-recon; sid:200004648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambrosecourt.com",nocase; http_uri; content:"/our/ourtime/ourtime.html",nocase; classtype:attempted-recon; sid:200004649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/njk/25_40_24_5e_40_26_40_26_28_29_23_23_5e_23_24_26_5e_25_26_40_5e_28_23_26.html",nocase; classtype:attempted-recon; sid:200004650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anekaslot.com",nocase; http_uri; content:"/jps/webmail_reset.htm",nocase; classtype:attempted-recon; sid:200004651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200004652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe2.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200004653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly93zxetnmrlodiud2vilmfwcc8znzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxi5lze1lziwmjeznzg1mjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxiznzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu0znzg1mjf3zwjtyxn0zxi5lze1lziwmjfjdw5plmn6nto1nibbttm3oduymtu6ntygqu13zwjtyxn0zxiznzg1mjejd2vibwfzdgvyqgn1bmkuy3o=",nocase; classtype:attempted-recon; sid:200004654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly9ua3yuchvil3h5nt83oet4elzsag1mzndzjmfsdd1tzwrpysnav2x0wvhomfpvqnpkr2x1y0hkcgvtrxvim0puolbcy3ppmu4yzgrladg2ennfduhvdu02qxphujjmuhv5zw5ork5ecvu=",nocase; classtype:attempted-recon; sid:200004655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96574574&amp\;s1=d2cb2653d154e850-5ea5960ca629f275326f9e81&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200004656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96668170&amp\;s1=2b94eb26dd71a6e0-5ea5961f20937a71e917f602&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200004657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.florense.com.br",nocase; http_uri; content:"/faotn/",nocase; classtype:attempted-recon; sid:200004658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.florense.com.br",nocase; http_uri; content:"/mostety/plinfer/",nocase; classtype:attempted-recon; sid:200004659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.florense.com.br",nocase; http_uri; content:"/mostety/plinfer/login.php?cmd=submit_log&id=mtgzmjq4ndg3oq==mtgzmjq4ndg3oq==&session=mtgzmjq4ndg3oq==mtgzmjq4ndg3oq==",nocase; classtype:attempted-recon; sid:200004660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.florense.com.br",nocase; http_uri; content:"/wind/btele/",nocase; classtype:attempted-recon; sid:200004661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/43l7nxncafyxdiaecwxblt0yo2hn7epz",nocase; classtype:attempted-recon; sid:200004662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/aju8uu3l7x4uusi7v53z09uk6rvwd161",nocase; classtype:attempted-recon; sid:200004663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/b9fu9axf9rcv7bhjp80fpcm8zna5wcwi",nocase; classtype:attempted-recon; sid:200004664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl",nocase; classtype:attempted-recon; sid:200004665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4",nocase; classtype:attempted-recon; sid:200004666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pandadoc.com",nocase; http_uri; content:"/p/96f48ddb9415f1307e22c50a18ad07c1785a5164?",nocase; classtype:attempted-recon; sid:200004667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/22f3qw",nocase; classtype:attempted-recon; sid:200004668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/cmxgsj",nocase; classtype:attempted-recon; sid:200004669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/lhwhl9",nocase; classtype:attempted-recon; sid:200004670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200004671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/2skowwypyb",nocase; classtype:attempted-recon; sid:200004672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/6dfhh1yrol",nocase; classtype:attempted-recon; sid:200004673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/izmlfzanc-",nocase; classtype:attempted-recon; sid:200004674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/lsmho6dyl-",nocase; classtype:attempted-recon; sid:200004675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/wywajnlbtl",nocase; classtype:attempted-recon; sid:200004676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php",nocase; classtype:attempted-recon; sid:200004677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php?starten=4geqwfau8kaypmmfbcrv0zhhxbrd7q&amp\;shuffluri?=csmdd37bht6zgxq2ijem",nocase; classtype:attempted-recon; sid:200004678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assoalhosmadeiras.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200004679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atmostechnology-my.sharepoint.com",nocase; http_uri; content:"/personal/amalia_atmostechnology_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=uiyaiqprc2ikxq0mezirqthais%2fdp9mp1hyqhjkscj0%3d&docid=1_1cbd4797f2749435a8f30af1a3f2d36b5&wdformid=%7b890161c9%2deb6d%2d44fc%2d9a59%2d0e4400a27203%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200004680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att-yahoo.meculinkvolt.com",nocase; http_uri; content:"/at&amp\;t",nocase; classtype:attempted-recon; sid:200004681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att-yahoo.meculinkvolt.com",nocase; http_uri; content:"/at&t/",nocase; classtype:attempted-recon; sid:200004682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aud-234567899786756fgh9ugfyfugih.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/audcallpoiuytrew.html#z3jhzw1llmhhbmrac3bhcmsuy28ubno=&amp\;data=04|01|graeme.hand@spark.co.nz|d963154c7cf54226057c08d9bfed11ac|f6b3cec6a8624a409ab400d6e11e6f0f|0|0|637751849189433096|unknown|twfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0=|2000&amp\;sdata=0y5avc3e2r4b8jzzra5t+/k6ankh/yrxm6g0ovt4ayw=&amp\;reserved=0",nocase; classtype:attempted-recon; sid:200004683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authy98987654345678765432456787654324567.ams3.digitaloceanspaces.com",nocase; http_uri; content:"/9876545678ytrderftgy-987654excgyuyfdr4e5r6tyuhy7t6r5edrfgvcxrde5r6thjhgvcxdrse45r6t7yuhijuy7t6fdcgvhbjhugyft/8y7t6rf5tghbjhvgyft7y8iujuyt7fyguihjjbvgftgyuhiugyf/m9888836748484774784747654323456787654323456787654323456786543234567654321345676543234567876543234567654321345678765432345676543234567543.html?alt=media&token=eceadc54-a951-44b8-ae51-18aaf8c8e92f&ydvbobeyrieyhdojctzngjogzdppclhdnsmpr0xzsyawtxqkuy=fp0lbzflkqiw7nsohndg&email=redacted@abuse.ionos.com&rnzpcmqgrndyul5txaxxcrdtghnyruq8rlrzxupc4losotexwubalpdd1kiito7qnikbrqeq8esgf30s9eh10cdwsauipwj38f1k",nocase; classtype:attempted-recon; sid:200004684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avyuktashop.com",nocase; http_uri; content:"/wp-content/schwab-ehi/adm/index.html",nocase; classtype:attempted-recon; sid:200004685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awdescargas.com",nocase; http_uri; content:"/peliculas",nocase; classtype:attempted-recon; sid:200004686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azeioaz.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200004687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ballost.org",nocase; http_uri; content:"/barbara_palvinic_breakingnews/?a=barbara_palvin&amp\;p=bitcoin_prime&amp\;cep=qra0tipfgaboldz77_jbsy_ezw3obpceykaqvhypvbzx7xzkctmjl0begcfdvwvcxytsr6voipvtjqtcmvyqhqj-m1fziqmka5jed0jfi4yld_pks1-s4hv7nmw3-chwol7szgua0lpcfcwkjbrktdpcvmtnqrzc2lpkupgrhk-voxqdxv5ihshklxa8kggze-pgbjahdbpwgter8zynuvlcxtjh8uaburxdgcnajygihskbucpqxlamo_qzrmcei8xl4jd3sy4lmwyphk4vwl63-ftji72xhoq0pj5iwxpgc7gdwdyznauhtxf-iyhp0s9yxrnlzsl4v4anyu89q-j8zlx0mfj_8na1q2mjqtjfyxiu8bvg0exrhzo-3gy6-vdhage13eudintavhvlfontd-qbjywx5nhik-6xm4u-yvtfvpmd_jnkkvf515r05pd1loyc_themttltp0dznp3wpgwfq6-lzhhvy9jwboql8avkg6d1wrw1pahkfif_n36hviyjvmlfivfstiqcepp65cbnti6kqhiysjuwieb72zcxnftjjocm3egaeiw&amp\;lptoken=16f22589212161c89401&amp\;keyword=job+search+&amp\;geo=hu&amp\;campaignname=hu+dp+desktop+asap&amp\;device=desktop&amp\;os=windows+10&amp\;browser=firefox+89&amp\;carrier=unknown&amp\;source=434214235&amp\;bid=0.0065&amp\;clickid=86368833580",nocase; classtype:attempted-recon; sid:200004688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bamboobypanda.com",nocase; http_uri; content:"/r",nocase; classtype:attempted-recon; sid:200004689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses",nocase; classtype:attempted-recon; sid:200004690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses/",nocase; classtype:attempted-recon; sid:200004691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baovesusonglcxt.com",nocase; http_uri; content:"/wp-includes/index.html",nocase; classtype:attempted-recon; sid:200004692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bardaiconnect.com",nocase; http_uri; content:"/app/listeners/ae/n-nv6588123/ae/ae/verify/sms.php",nocase; classtype:attempted-recon; sid:200004693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=d96ydzq8vuilprdurtucov60qbtyz20222a95vav4da%3d&docid=1_1f81a6ca97d114a5f8e9829362518b16d&wdformid=%7b11b3b6fc%2d6e67%2d434d%2da029%2d3afe98d81a11%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200004694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=d96ydzq8vuilprdurtucov60qbtyz20222a95vav4da%3d&docid=1_1f81a6ca97d114a5f8e9829362518b16d&wdformid=%7b11b3b6fc%2d6e67%2d434d%2da029%2d3afe98d81a11%7d&action=formsubmit&cid=57d50783-8fd3-4515-8ab3-24c639533fdf",nocase; classtype:attempted-recon; sid:200004695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"belinqed.ge",nocase; http_uri; content:"/wp-admin/chss/chase1.html",nocase; classtype:attempted-recon; sid:200004696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendmytrend.com",nocase; http_uri; content:"/mp/china/index.php?login=sindy.zhu@swift.com",nocase; classtype:attempted-recon; sid:200004697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus022.blogspot.com",nocase; http_uri; content:"//",nocase; classtype:attempted-recon; sid:200004698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/54sd5s",nocase; classtype:attempted-recon; sid:200004699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/bankinter-verificacion",nocase; classtype:attempted-recon; sid:200004700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fjxoo",nocase; classtype:attempted-recon; sid:200004701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3kf",nocase; classtype:attempted-recon; sid:200004702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxsz",nocase; classtype:attempted-recon; sid:200004703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsf6l",nocase; classtype:attempted-recon; sid:200004704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fspsr",nocase; classtype:attempted-recon; sid:200004705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsqst",nocase; classtype:attempted-recon; sid:200004706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fsrrk",nocase; classtype:attempted-recon; sid:200004707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fszqs",nocase; classtype:attempted-recon; sid:200004708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/gbhnjkmjnb",nocase; classtype:attempted-recon; sid:200004709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/kigmtb32",nocase; classtype:attempted-recon; sid:200004710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/synologymtb",nocase; classtype:attempted-recon; sid:200004711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly.",nocase; http_uri; content:"/3ijwsm2",nocase; classtype:attempted-recon; sid:200004712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2iz03nf",nocase; classtype:attempted-recon; sid:200004713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2kduy2u",nocase; classtype:attempted-recon; sid:200004714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nog4ow?facebook_update",nocase; classtype:attempted-recon; sid:200004715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nwrbgj",nocase; classtype:attempted-recon; sid:200004716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2oq6dhz",nocase; classtype:attempted-recon; sid:200004717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2p28z0h",nocase; classtype:attempted-recon; sid:200004718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2q7fcpg",nocase; classtype:attempted-recon; sid:200004719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2uwvcnh",nocase; classtype:attempted-recon; sid:200004720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2vuwbzk",nocase; classtype:attempted-recon; sid:200004721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2we8ivg?facebook_update",nocase; classtype:attempted-recon; sid:200004722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wqlrea",nocase; classtype:attempted-recon; sid:200004723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wwa0gq",nocase; classtype:attempted-recon; sid:200004724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zaee65",nocase; classtype:attempted-recon; sid:200004725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zbhqng?facebook_update",nocase; classtype:attempted-recon; sid:200004726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zejaht",nocase; classtype:attempted-recon; sid:200004727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zomh31?confirmation",nocase; classtype:attempted-recon; sid:200004728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zu47a1",nocase; classtype:attempted-recon; sid:200004729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zu47a1?=/https://internetbanking.caixa.gov.br",nocase; classtype:attempted-recon; sid:200004730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30dwddq",nocase; classtype:attempted-recon; sid:200004731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30fbxqk",nocase; classtype:attempted-recon; sid:200004732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30ggqsn",nocase; classtype:attempted-recon; sid:200004733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/30vy89r",nocase; classtype:attempted-recon; sid:200004734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/310rtwp",nocase; classtype:attempted-recon; sid:200004735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/316q3yb",nocase; classtype:attempted-recon; sid:200004736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/319qtui",nocase; classtype:attempted-recon; sid:200004737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31cwtqd?facebook_update",nocase; classtype:attempted-recon; sid:200004738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31d3mp6?facebook_service",nocase; classtype:attempted-recon; sid:200004739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31v83za",nocase; classtype:attempted-recon; sid:200004740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31xebzq",nocase; classtype:attempted-recon; sid:200004741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/33ipjf7",nocase; classtype:attempted-recon; sid:200004742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/33pcwtj",nocase; classtype:attempted-recon; sid:200004743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/34mhgdg",nocase; classtype:attempted-recon; sid:200004744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/37r8zo3",nocase; classtype:attempted-recon; sid:200004745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38xmo4d",nocase; classtype:attempted-recon; sid:200004746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/392hszz",nocase; classtype:attempted-recon; sid:200004747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aetm80",nocase; classtype:attempted-recon; sid:200004748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3afo6kx",nocase; classtype:attempted-recon; sid:200004749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3an4lcn",nocase; classtype:attempted-recon; sid:200004750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aqvwmn",nocase; classtype:attempted-recon; sid:200004751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3b4sqa1",nocase; classtype:attempted-recon; sid:200004752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bbkocy",nocase; classtype:attempted-recon; sid:200004753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bdkpfx?facebook_update",nocase; classtype:attempted-recon; sid:200004754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bmjhx1?confirmation",nocase; classtype:attempted-recon; sid:200004755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bq4stv?confirmation",nocase; classtype:attempted-recon; sid:200004756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bsgkin",nocase; classtype:attempted-recon; sid:200004757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bv7pr1",nocase; classtype:attempted-recon; sid:200004758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bvwofv?confirmation",nocase; classtype:attempted-recon; sid:200004759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3c7nozm",nocase; classtype:attempted-recon; sid:200004760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ca8owp?facebook_update",nocase; classtype:attempted-recon; sid:200004761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cahvv5help-center-notice-comunity",nocase; classtype:attempted-recon; sid:200004762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cdz7o7",nocase; classtype:attempted-recon; sid:200004763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3clopj4",nocase; classtype:attempted-recon; sid:200004764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cpqerq",nocase; classtype:attempted-recon; sid:200004765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cu5vct",nocase; classtype:attempted-recon; sid:200004766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cvl6ir",nocase; classtype:attempted-recon; sid:200004767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cxchrp?facebook_update",nocase; classtype:attempted-recon; sid:200004768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3czqfzo?confirmation",nocase; classtype:attempted-recon; sid:200004769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3d7ezub?facebook_update",nocase; classtype:attempted-recon; sid:200004770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3dj0r1p",nocase; classtype:attempted-recon; sid:200004771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3dky0ds?facebook_update",nocase; classtype:attempted-recon; sid:200004772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3e1ju3u",nocase; classtype:attempted-recon; sid:200004773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3e3wjwp",nocase; classtype:attempted-recon; sid:200004774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3e5qg5x?confirmation",nocase; classtype:attempted-recon; sid:200004775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3eeiwqv",nocase; classtype:attempted-recon; sid:200004776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ego3xw?redirect=system",nocase; classtype:attempted-recon; sid:200004777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ejh45a",nocase; classtype:attempted-recon; sid:200004778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3eoqvcn",nocase; classtype:attempted-recon; sid:200004779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3f0vbdn",nocase; classtype:attempted-recon; sid:200004780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fb9f8f",nocase; classtype:attempted-recon; sid:200004781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fixuqn",nocase; classtype:attempted-recon; sid:200004782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fk3blu",nocase; classtype:attempted-recon; sid:200004783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fmvby5?facebook_update",nocase; classtype:attempted-recon; sid:200004784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fs7ocl",nocase; classtype:attempted-recon; sid:200004785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ftyhsg",nocase; classtype:attempted-recon; sid:200004786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ftzfy4",nocase; classtype:attempted-recon; sid:200004787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fvmq5q",nocase; classtype:attempted-recon; sid:200004788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3guiinq?confirmation",nocase; classtype:attempted-recon; sid:200004789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3gxztog",nocase; classtype:attempted-recon; sid:200004790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3gyfnlm?confirmation",nocase; classtype:attempted-recon; sid:200004791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hhwa3b?facebook_update",nocase; classtype:attempted-recon; sid:200004792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hiz5om",nocase; classtype:attempted-recon; sid:200004793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hkcnfx",nocase; classtype:attempted-recon; sid:200004794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hvucnu",nocase; classtype:attempted-recon; sid:200004795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hyrr9r",nocase; classtype:attempted-recon; sid:200004796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hyyzhi",nocase; classtype:attempted-recon; sid:200004797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hzbrur",nocase; classtype:attempted-recon; sid:200004798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hzjg7w",nocase; classtype:attempted-recon; sid:200004799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hzzlzf?confirmation",nocase; classtype:attempted-recon; sid:200004800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3i2dhno?confirmation",nocase; classtype:attempted-recon; sid:200004801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3i8tjul",nocase; classtype:attempted-recon; sid:200004802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3iptpcl?https=checkpoint",nocase; classtype:attempted-recon; sid:200004803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jow35g?confirmation",nocase; classtype:attempted-recon; sid:200004804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqfusj?confirmation",nocase; classtype:attempted-recon; sid:200004805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqmbfu",nocase; classtype:attempted-recon; sid:200004806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jvodhm?confirmation",nocase; classtype:attempted-recon; sid:200004807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jxszq1?confirmation",nocase; classtype:attempted-recon; sid:200004808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3k2aaqc?facebook_update",nocase; classtype:attempted-recon; sid:200004809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kdifqr",nocase; classtype:attempted-recon; sid:200004810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ko5t3l",nocase; classtype:attempted-recon; sid:200004811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kq9ttx",nocase; classtype:attempted-recon; sid:200004812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kueruz",nocase; classtype:attempted-recon; sid:200004813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kxfgbu",nocase; classtype:attempted-recon; sid:200004814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3l4jpqg?facebook_update",nocase; classtype:attempted-recon; sid:200004815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ldovbh",nocase; classtype:attempted-recon; sid:200004816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lgmoqh",nocase; classtype:attempted-recon; sid:200004817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lgqunq?confirmation",nocase; classtype:attempted-recon; sid:200004818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mbfdro?/facebookhelp",nocase; classtype:attempted-recon; sid:200004819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mcvvxw",nocase; classtype:attempted-recon; sid:200004820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mgij5v",nocase; classtype:attempted-recon; sid:200004821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mkihc9",nocase; classtype:attempted-recon; sid:200004822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mrtcap",nocase; classtype:attempted-recon; sid:200004823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mryk6q",nocase; classtype:attempted-recon; sid:200004824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mvat1h?confirmation",nocase; classtype:attempted-recon; sid:200004825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mwnmia?confirmation",nocase; classtype:attempted-recon; sid:200004826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3na7s78?facebook_update",nocase; classtype:attempted-recon; sid:200004827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nddkta",nocase; classtype:attempted-recon; sid:200004828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nicrtr",nocase; classtype:attempted-recon; sid:200004829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nvr2mn",nocase; classtype:attempted-recon; sid:200004830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nx06e6?confirmation",nocase; classtype:attempted-recon; sid:200004831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3o4jvkk",nocase; classtype:attempted-recon; sid:200004832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ogl37p",nocase; classtype:attempted-recon; sid:200004833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ohpdsj",nocase; classtype:attempted-recon; sid:200004834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3oomw6f",nocase; classtype:attempted-recon; sid:200004835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3pasn1q",nocase; classtype:attempted-recon; sid:200004836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3phrfct",nocase; classtype:attempted-recon; sid:200004837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3png8xp",nocase; classtype:attempted-recon; sid:200004838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3pqid6z?confirmation",nocase; classtype:attempted-recon; sid:200004839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qc8jtv",nocase; classtype:attempted-recon; sid:200004840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qlgss1",nocase; classtype:attempted-recon; sid:200004841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qol3ev",nocase; classtype:attempted-recon; sid:200004842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qplrme",nocase; classtype:attempted-recon; sid:200004843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qvucvy?facebook_update",nocase; classtype:attempted-recon; sid:200004844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3qxas0u?facebook_update",nocase; classtype:attempted-recon; sid:200004845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3r49apq?facebook_update",nocase; classtype:attempted-recon; sid:200004846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3r8xxmg?facebook_update",nocase; classtype:attempted-recon; sid:200004847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3rd3dgx",nocase; classtype:attempted-recon; sid:200004848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3reovvv",nocase; classtype:attempted-recon; sid:200004849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3rucafb?confirmations",nocase; classtype:attempted-recon; sid:200004850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3sdxkuf",nocase; classtype:attempted-recon; sid:200004851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tks2um",nocase; classtype:attempted-recon; sid:200004852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tzc89x",nocase; classtype:attempted-recon; sid:200004853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3vtbyq5",nocase; classtype:attempted-recon; sid:200004854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3vyh0x9",nocase; classtype:attempted-recon; sid:200004855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3w8ru6g?confirmation",nocase; classtype:attempted-recon; sid:200004856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3wb6m3i",nocase; classtype:attempted-recon; sid:200004857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3xhfy9m?facebook_update",nocase; classtype:attempted-recon; sid:200004858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3xkuef1?confirmation",nocase; classtype:attempted-recon; sid:200004859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3xrdvez?facebook_update",nocase; classtype:attempted-recon; sid:200004860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3yatzv9?confirmation",nocase; classtype:attempted-recon; sid:200004861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/bancamps-_",nocase; classtype:attempted-recon; sid:200004862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/bancamps-web",nocase; classtype:attempted-recon; sid:200004863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/bsm-sicurezza",nocase; classtype:attempted-recon; sid:200004864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/click-confirm",nocase; classtype:attempted-recon; sid:200004865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/coinspot-claim-bonus",nocase; classtype:attempted-recon; sid:200004866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/community-details",nocase; classtype:attempted-recon; sid:200004867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/confirm-click",nocase; classtype:attempted-recon; sid:200004868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/credem2021",nocase; classtype:attempted-recon; sid:200004869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/dhlexpresschlpay",nocase; classtype:attempted-recon; sid:200004870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/edoardopolaccoufficiale",nocase; classtype:attempted-recon; sid:200004871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/i-13orange",nocase; classtype:attempted-recon; sid:200004872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/i-14orange",nocase; classtype:attempted-recon; sid:200004873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/id-lockpages",nocase; classtype:attempted-recon; sid:200004874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/id-locksystem",nocase; classtype:attempted-recon; sid:200004875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/info-details-notification",nocase; classtype:attempted-recon; sid:200004876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/informativa-sicurezza-web+",nocase; classtype:attempted-recon; sid:200004877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/ip13-orange",nocase; classtype:attempted-recon; sid:200004878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/ip14-orange",nocase; classtype:attempted-recon; sid:200004879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/lrs-gov1",nocase; classtype:attempted-recon; sid:200004880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/main-pages",nocase; classtype:attempted-recon; sid:200004881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/mps-banca",nocase; classtype:attempted-recon; sid:200004882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/mr-pin",nocase; classtype:attempted-recon; sid:200004883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id12",nocase; classtype:attempted-recon; sid:200004884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id13",nocase; classtype:attempted-recon; sid:200004885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id2",nocase; classtype:attempted-recon; sid:200004886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id3",nocase; classtype:attempted-recon; sid:200004887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/orange-id4",nocase; classtype:attempted-recon; sid:200004888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/page-infromation",nocase; classtype:attempted-recon; sid:200004889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/pandemicreliefpackage",nocase; classtype:attempted-recon; sid:200004890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/policy-pages",nocase; classtype:attempted-recon; sid:200004891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/portale-mps-attivazione",nocase; classtype:attempted-recon; sid:200004892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/securnormativa",nocase; classtype:attempted-recon; sid:200004893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/temp-disable",nocase; classtype:attempted-recon; sid:200004894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifica-info-accesso",nocase; classtype:attempted-recon; sid:200004895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifikasipemblokiran_id",nocase; classtype:attempted-recon; sid:200004896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2p3bbbs",nocase; classtype:attempted-recon; sid:200004897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2sfygwy",nocase; classtype:attempted-recon; sid:200004898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3aolo2y",nocase; classtype:attempted-recon; sid:200004899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3bqoevf",nocase; classtype:attempted-recon; sid:200004900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3g1epw3",nocase; classtype:attempted-recon; sid:200004901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3jrtmmu",nocase; classtype:attempted-recon; sid:200004902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3kdi2ts",nocase; classtype:attempted-recon; sid:200004903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3koilft",nocase; classtype:attempted-recon; sid:200004904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3vufm8l",nocase; classtype:attempted-recon; sid:200004905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3xmjxs4",nocase; classtype:attempted-recon; sid:200004906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/a/warning?hash=3a7rdwh&amp\;url=http%3a%2f%2fon.cef-asseletronica.com%2f",nocase; classtype:attempted-recon; sid:200004907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/taxirsxcy",nocase; classtype:attempted-recon; sid:200004908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blackbearcccouk-my.sharepoint.com",nocase; http_uri; content:"/personal/accounts_blackbearcc_co_uk/_layouts/15/onedrive.aspx?id=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments%2fngb%20urgente%20substanti%c3%able%20update%20%5f%20voorstel%2epdf&amp\;parent=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments&amp\;originalpath=ahr0chm6ly9ibgfja2jlyxjjy2nvdwstbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvywnjb3vudhnfymxhy2tizwfyy2nfy29fdwsvrve5as01b19mukjbcutzeunhv3eznw9ccfbtmze3b2fsrnrgnhpzuenbvlfiqt9ydgltzt1tqjzyquroodjvzw",nocase; classtype:attempted-recon; sid:200004909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodegalatinacorp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/012dsd_fiestamart_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t3v5ldmmhrtlw5cyiohlp9z4yo7ufnrop9j1plyfdkm%3d&docid=1_1d89d259f7e704301aca26ac4dbabaa8d&wdformid=%7bfeb771e5%2d93ee%2d4015%2d8e87%2dd1c30d0f406a%7d&action=formsubmit&cid=f609fe16-56c4-4e2b-a964-75e250d31c99",nocase; classtype:attempted-recon; sid:200004910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bofa.com-onlinebanking.com",nocase; http_uri; content:"/xvezwsfzwwkhhm3b6zezgdfzeahvksep0ulvwu1nvvldosfpvv20xc1phzdnkruzuzfrstfnxwxdhme01vm5gt1n6zexlwfzvuvc5b1kzsjnrv0ywvm10sljuqjrzetk2vfvwrlvtafpovkeyujaxwgjuqmhnrtvzvdfkyvpsrljzbtb3tlv4yvjvsm9wwepzyznvefmymhdubuphyudob1pwbhlkm0jpverkevdytlbiamhcvdbjmvlxehlxazqxzws5su1uzg1rblpavkhsdvf5ohdua1pytjnvcmfwvmpvwfpgufmwdfzwvjvusfzoym0xu1rsum9arxblvku1cmjxc3jkeja5ls1iodg4n2zmyjnmymfhntzlymi4ntqymjy4yjdlyzjjyjc1owmwy2yx",nocase; classtype:attempted-recon; sid:200004911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bom.to",nocase; http_uri; content:"/nlozan9lgoapq",nocase; classtype:attempted-recon; sid:200004912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bonomequedoencasa.blogspot.com",nocase; http_uri; content:"/?aplicar",nocase; classtype:attempted-recon; sid:200004913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bre.is",nocase; http_uri; content:"/2r9pyocy",nocase; classtype:attempted-recon; sid:200004914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/q72e",nocase; classtype:attempted-recon; sid:200004915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/qiq3",nocase; classtype:attempted-recon; sid:200004916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"candaois.04a9c7c.wcomhost.com",nocase; http_uri; content:"/swisspost",nocase; classtype:attempted-recon; sid:200004917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capacitaciongratisbo.com",nocase; http_uri; content:"/css/iouytreyu/09876543456789pdfacrobat6657898/iuytrjhfghj/llin/lin",nocase; classtype:attempted-recon; sid:200004918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casbygroup.com",nocase; http_uri; content:"/rew/sp_xx",nocase; classtype:attempted-recon; sid:200004919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casbygroup.com",nocase; http_uri; content:"/rew/sp_xx/kmdyzmwe=/",nocase; classtype:attempted-recon; sid:200004920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.shopify.com",nocase; http_uri; content:"/s/files/1/0533/5367/6992/t/3/assets/home.html",nocase; classtype:attempted-recon; sid:200004921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cekduit.co.id",nocase; http_uri; content:"/credem/",nocase; classtype:attempted-recon; sid:200004922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centromedicoviladomat.com",nocase; http_uri; content:"/index.php?option=com_content&view=article&id=67",nocase; classtype:attempted-recon; sid:200004923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chronopostvalidation.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post_12.html",nocase; classtype:attempted-recon; sid:200004924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci3.googleusercontent.com",nocase; http_uri; content:"/proxy/rdh-rjsrv9zzrx57iscgov74o1gka4qjdfj01qr7v8-pkjgyvn50tivt7pzqgm5kuqdmonqle3f8eq_t8f4xl6jdozabmf2lxy-888ai8hdji633rg",nocase; classtype:attempted-recon; sid:200004925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci4.googleusercontent.com",nocase; http_uri; content:"/proxy/djc3ckf7jcnj8l0duyaqyjwffeskzbccy9spjiauj_jwrplgw0ahyaf1xozvm6n_fjn8q1-2vkhqqujjr1en3qej703lyxxujt6tto-ttwsl6hgsggp3ehcc",nocase; classtype:attempted-recon; sid:200004926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci4.googleusercontent.com",nocase; http_uri; content:"/proxy/zjba9cvtmkfnoveyofx6gqong0kqi3s69d9o2y32fmu_gankb59tj-rb79bolx0bwbsemnonfhh2esy9olfdp-20gybztkzstfhfheqrrjuefxwiwkqws29wxm6tdobikwz-qkzfphpaldfr",nocase; classtype:attempted-recon; sid:200004927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cimslp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/eric_cimsltd_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wnhqsp58ikn1qzzozpe2oiw%2fmizdr53wegdbyscml7y%3d&amp\;docid=1_1207bcf2f71094b5cb97dcb5bea3e1a3a&amp\;wdformid=%7bd98de46a%2d2777%2d417f%2dbbcf%2d5f08c8244727%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200004928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cingular-oac.qpass.com",nocase; http_uri; content:"/oac/html/signin.do",nocase; classtype:attempted-recon; sid:200004929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clck.ru",nocase; http_uri; content:"/yc8bd&post=665308711_37&cc_key",nocase; classtype:attempted-recon; sid:200004930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clck.ru",nocase; http_uri; content:"/yzuft&post=665308711_32&cc_key",nocase; classtype:attempted-recon; sid:200004931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.email.office.com",nocase; http_uri; content:"/?qs=9cf30363dd29315c3e11be7b9f86e0023a565c20a2375038e17cde83e3918d351e9c862894eecd698e1a9bb86157937bcf1b994ad1bf797a",nocase; classtype:attempted-recon; sid:200004932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.icptrack.com",nocase; http_uri; content:"/icp/relay.php?r=57372110&amp\;msgid=807563&amp\;act=af7a&amp\;c=1365247&amp\;destination=https://www.linkedin.com/&amp\;cf=17638&amp\;v=6023ca6bc5e4f8b8568ed04ff6a646a7d7757336e750d772ecc1cb2b3b6063b4",nocase; classtype:attempted-recon; sid:200004933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.mail.onedrive.com",nocase; http_uri; content:"/?qs=db04a8b2d7b04d1f6b3c69c4c5805dfc93097e61c800b87bab9654d4ce1ee7f86c05b36196ea1c673c13d490edbadd368c6e8f39eb68b3bb",nocase; classtype:attempted-recon; sid:200004934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.message.fruit.com",nocase; http_uri; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280",nocase; classtype:attempted-recon; sid:200004935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.promote.weebly.com",nocase; http_uri; content:"/ls/click?upn=3g-2boalxhqfd9acjc8rrrq2jlh6rgeuxwss-2fw0mkyvdkedasfpapk6r0eu9qosj5dqxo-2ffqmvckqnfqezhcwmbrwfjbud54fzjoqkt2pc56cw2fsctiw05n-2bmavqaphmma15i_i-2bxluspfrnjydjcne-2bgvz5fubrzozhohuynwixc51d0vqx9bnegrlzmzec8xiyizaij9uwzyipcj4tvmmuvceuovhieydgzug-2faycfmuten8q2ve-2fxxhi7lsyycrzptvtf-2bflqssh1z5wvcayupdrij0knzjcvq0-2b0gsk4r-2fsixauaoasbwca7njlfsfaareskt-2flycrvse5hp5eryt9jgldbxjl0ais-2bmnymqfyxdots7jp4yuhsfh6xjhbmlzdrocekgrjdeaywfvigsyjbqfy023-2fxt3br9pzrmwkoanrpnunf97vteczlsnodmyc3q2yfbh29v9ukvc5owz8ktx49xwflv-2bslrskfu3x8gzib8qoler2sjcvbej5vxmskx7zyt2rmyz81igu-2fkjze-2fq9wzpj-2fga-2fxzw5sqtzbgl-2fqw0s4pbzmnddffnx4svkoa4tnyjnda4suaodgxxbnqropimad6ohemanxy9eovs-3d",nocase; classtype:attempted-recon; sid:200004936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clone.jcasitetest.com",nocase; http_uri; content:"/linebade/piled.php?email=cs.ha@cpone.co.kr",nocase; classtype:attempted-recon; sid:200004937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud-dot-chaser-331005.uk.r.appspot.com",nocase; http_uri; content:"/#moreinfo@widomaker.com",nocase; classtype:attempted-recon; sid:200004938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...",nocase; classtype:attempted-recon; sid:200004939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......",nocase; classtype:attempted-recon; sid:200004940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........",nocase; classtype:attempted-recon; sid:200004941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/............",nocase; classtype:attempted-recon; sid:200004942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........x",nocase; classtype:attempted-recon; sid:200004943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........x...",nocase; classtype:attempted-recon; sid:200004944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......x",nocase; classtype:attempted-recon; sid:200004945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......x...",nocase; classtype:attempted-recon; sid:200004946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx",nocase; classtype:attempted-recon; sid:200004947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx......",nocase; classtype:attempted-recon; sid:200004948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...",nocase; classtype:attempted-recon; sid:200004949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../......",nocase; classtype:attempted-recon; sid:200004950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x",nocase; classtype:attempted-recon; sid:200004951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x...",nocase; classtype:attempted-recon; sid:200004952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x...x",nocase; classtype:attempted-recon; sid:200004953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...xx",nocase; classtype:attempted-recon; sid:200004954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...xx...",nocase; classtype:attempted-recon; sid:200004955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x",nocase; classtype:attempted-recon; sid:200004956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x...",nocase; classtype:attempted-recon; sid:200004957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x......",nocase; classtype:attempted-recon; sid:200004958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xx",nocase; classtype:attempted-recon; sid:200004959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xx...",nocase; classtype:attempted-recon; sid:200004960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xxx",nocase; classtype:attempted-recon; sid:200004961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx...x",nocase; classtype:attempted-recon; sid:200004962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...x",nocase; classtype:attempted-recon; sid:200004963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...x...",nocase; classtype:attempted-recon; sid:200004964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xx",nocase; classtype:attempted-recon; sid:200004965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx",nocase; classtype:attempted-recon; sid:200004966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...",nocase; classtype:attempted-recon; sid:200004967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx......",nocase; classtype:attempted-recon; sid:200004968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx.........",nocase; classtype:attempted-recon; sid:200004969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx............",nocase; classtype:attempted-recon; sid:200004970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./",nocase; classtype:attempted-recon; sid:200004971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./...",nocase; classtype:attempted-recon; sid:200004972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./......",nocase; classtype:attempted-recon; sid:200004973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./.........",nocase; classtype:attempted-recon; sid:200004974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./...x",nocase; classtype:attempted-recon; sid:200004975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./x",nocase; classtype:attempted-recon; sid:200004976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./x...",nocase; classtype:attempted-recon; sid:200004977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...x",nocase; classtype:attempted-recon; sid:200004978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...x...",nocase; classtype:attempted-recon; sid:200004979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.x",nocase; classtype:attempted-recon; sid:200004980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.x...",nocase; classtype:attempted-recon; sid:200004981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.xx",nocase; classtype:attempted-recon; sid:200004982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx",nocase; classtype:attempted-recon; sid:200004983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...",nocase; classtype:attempted-recon; sid:200004984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx......",nocase; classtype:attempted-recon; sid:200004985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x",nocase; classtype:attempted-recon; sid:200004986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...",nocase; classtype:attempted-recon; sid:200004987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x......",nocase; classtype:attempted-recon; sid:200004988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........",nocase; classtype:attempted-recon; sid:200004989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x............",nocase; classtype:attempted-recon; sid:200004990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x",nocase; classtype:attempted-recon; sid:200004991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/",nocase; classtype:attempted-recon; sid:200004992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/...",nocase; classtype:attempted-recon; sid:200004993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/......",nocase; classtype:attempted-recon; sid:200004994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/........",nocase; classtype:attempted-recon; sid:200004995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/...x",nocase; classtype:attempted-recon; sid:200004996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x",nocase; classtype:attempted-recon; sid:200004997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x...",nocase; classtype:attempted-recon; sid:200004998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x......",nocase; classtype:attempted-recon; sid:200004999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/xx",nocase; classtype:attempted-recon; sid:200005000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x......x",nocase; classtype:attempted-recon; sid:200005001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...x",nocase; classtype:attempted-recon; sid:200005002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...x...",nocase; classtype:attempted-recon; sid:200005003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...xx",nocase; classtype:attempted-recon; sid:200005004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...xxx",nocase; classtype:attempted-recon; sid:200005005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx",nocase; classtype:attempted-recon; sid:200005006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...",nocase; classtype:attempted-recon; sid:200005007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx......",nocase; classtype:attempted-recon; sid:200005008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...x",nocase; classtype:attempted-recon; sid:200005009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...x...",nocase; classtype:attempted-recon; sid:200005010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...xx",nocase; classtype:attempted-recon; sid:200005011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx",nocase; classtype:attempted-recon; sid:200005012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx...",nocase; classtype:attempted-recon; sid:200005013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx......",nocase; classtype:attempted-recon; sid:200005014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx.........",nocase; classtype:attempted-recon; sid:200005015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx...x",nocase; classtype:attempted-recon; sid:200005016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxxx",nocase; classtype:attempted-recon; sid:200005017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.x.xxx",nocase; classtype:attempted-recon; sid:200005018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.x.xxx...",nocase; classtype:attempted-recon; sid:200005019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.x",nocase; classtype:attempted-recon; sid:200005020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.x...",nocase; classtype:attempted-recon; sid:200005021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.xx",nocase; classtype:attempted-recon; sid:200005022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xxx.x",nocase; classtype:attempted-recon; sid:200005023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxx",nocase; classtype:attempted-recon; sid:200005024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx",nocase; classtype:attempted-recon; sid:200005025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx/x",nocase; classtype:attempted-recon; sid:200005026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx/x.",nocase; classtype:attempted-recon; sid:200005027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxx",nocase; classtype:attempted-recon; sid:200005028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxx...",nocase; classtype:attempted-recon; sid:200005029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxxx",nocase; classtype:attempted-recon; sid:200005030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize",nocase; classtype:attempted-recon; sid:200005031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-cli...",nocase; classtype:attempted-recon; sid:200005032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503",nocase; classtype:attempted-recon; sid:200005033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www--com-response_type-code-id_token&amp\;scope-openid-profile&amp\;response_mode-form_post&amp\;nonce-637402967941920791-y2fknjezmmqtzte1nc00njbklwfiotytowexmdcwytjlm2q2n2zlmdiwnjctowiyys00mzzhlwi0njctyzi3nmm2ogixzme4&amp\;ui_locales=en-us&amp\;mkt=en-us&amp\;client-request-idaa28d8e1-058b-4002-a687-8a271de76ed6&amp\;state=7ynxu_43bb49obxk6fyelmfrs5zpa0bltgntumd69tf91ft_9m0bsx-gadmxhr-754mywj7sdaghfnzhznzawczy-zaiek46cgccir6gurmildmgtns7hrsmtd9is8tcex7qd5izrcnveq5hvapci7o5wfvlbb23skrup7ujynpdzal8rxv-h9vd_qceedxdc7zv6qacmliyzgfchx1sasnit35gvd1uvbrktdrptsx8a66jqlysfuo03gjhggaeyflaca-wxtin2fb3qljmhq&amp\;x",nocase; classtype:attempted-recon; sid:200005034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_to",nocase; classtype:attempted-recon; sid:200005035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_token&amp\;scope-openid-",nocase; classtype:attempted-recon; sid:200005036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_token&amp\;scope-openid-profile&amp\;response_mode-form_post&amp\;nonce-637402967941920791-y2fknjezmmqtzte1nc00njbklwfiotytowexmdcwytjlm2q2n2zlmdiwnjctowiyys00mzzhlwi0njctyzi3nmm2ogixzme4&amp\;ui_locales=en-us&amp\;mkt=en-us&amp\;client-request-idaa28d8e1-058b-4002-a687-8a271de76ed6&amp\;state=7ynxu_43bb49obxk6fyelmfrs5zpa0bltgntumd69tf91ft_9m0bsx-gadmxhr-754mywj7sd",nocase; classtype:attempted-recon; sid:200005037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.j",nocase; classtype:attempted-recon; sid:200005038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.j...",nocase; classtype:attempted-recon; sid:200005039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.js(line",nocase; classtype:attempted-recon; sid:200005040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.js...",nocase; classtype:attempted-recon; sid:200005041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/x",nocase; classtype:attempted-recon; sid:200005042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/x...",nocase; classtype:attempted-recon; sid:200005043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xx/xx",nocase; classtype:attempted-recon; sid:200005044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxx",nocase; classtype:attempted-recon; sid:200005045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxx/",nocase; classtype:attempted-recon; sid:200005046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxxx",nocase; classtype:attempted-recon; sid:200005047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnam.md",nocase; http_uri; content:"/object/html_elements/laxx/en.php",nocase; classtype:attempted-recon; sid:200005048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coda.io",nocase; http_uri; content:"/d/microsoft-office365_duu9pzwq-rk",nocase; classtype:attempted-recon; sid:200005049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codepasta.app",nocase; http_uri; content:"/paste/c4tl1sfout2tbkhn5810/raw",nocase; classtype:attempted-recon; sid:200005050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cognitoforms.com",nocase; http_uri; content:"/governmentpandemicbonus/form3",nocase; classtype:attempted-recon; sid:200005051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communitychurch-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/infonoreply_communitychurch_tv/eburrky2tklimiiiqf0ia5kbbhkaxaypf06-08wf9wjebq?e=w5jmrb",nocase; classtype:attempted-recon; sid:200005052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confabint.com",nocase; http_uri; content:"/discounts_services/writing/loginform2d0e.php",nocase; classtype:attempted-recon; sid:200005053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=354917e2-ac99-45e1-96f9-8be4d200b522&cm_type=link&cm_link=e2ca05a6-2e96-43d5-b07a-cf1ef5e79b36&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200005054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=4e1943c3-7a68-47fb-93f5-16d2565a1cce&cm_type=link&cm_link=a4377bcd-c14a-4ace-8c62-a66fecd57e71&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200005055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=d5721ad4-aabf-4e4e-9a14-1b8e7738fbcf&cm_type=link&cm_link=f89aca33-6081-418d-89e6-c9efd6aa36cd&cm_destination=https://www.designbold.com/design/view/80zebbkpa2/presentation",nocase; classtype:attempted-recon; sid:200005056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-includes/js/crop/cm",nocase; classtype:attempted-recon; sid:200005057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php",nocase; classtype:attempted-recon; sid:200005058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200005059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200005060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200005061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;",nocase; classtype:attempted-recon; sid:200005062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp",nocase; classtype:attempted-recon; sid:200005063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515",nocase; classtype:attempted-recon; sid:200005064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515",nocase; classtype:attempted-recon; sid:200005065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4",nocase; classtype:attempted-recon; sid:200005066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200005067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13inboxlight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=jackdavis@eureliosollutions.com&.rand=13inboxlight.aspx?n=1774256418&fid=4",nocase; classtype:attempted-recon; sid:200005068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com",nocase; classtype:attempted-recon; sid:200005069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativeingredient.com",nocase; http_uri; content:"/wp-includes/images/verify/update/y.html",nocase; classtype:attempted-recon; sid:200005070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.com",nocase; http_uri; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html",nocase; classtype:attempted-recon; sid:200005071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cusstomerservicee.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/3yqokjg",nocase; classtype:attempted-recon; sid:200005073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/3yy01ci",nocase; classtype:attempted-recon; sid:200005074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/4ypfq09",nocase; classtype:attempted-recon; sid:200005075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/5yhe1qn",nocase; classtype:attempted-recon; sid:200005076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/7tycchs",nocase; classtype:attempted-recon; sid:200005077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/7yqfwsn",nocase; classtype:attempted-recon; sid:200005078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/9tycy2j",nocase; classtype:attempted-recon; sid:200005079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/aynunsk",nocase; classtype:attempted-recon; sid:200005080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ayw5mev",nocase; classtype:attempted-recon; sid:200005081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/byqp8mx",nocase; classtype:attempted-recon; sid:200005082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ctmlfil",nocase; classtype:attempted-recon; sid:200005083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/cyni5cc",nocase; classtype:attempted-recon; sid:200005084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/cyqucr4",nocase; classtype:attempted-recon; sid:200005085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/dkvkq49/",nocase; classtype:attempted-recon; sid:200005086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/gyqdc7m",nocase; classtype:attempted-recon; sid:200005087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/iyn1owx",nocase; classtype:attempted-recon; sid:200005088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/jttpwnp",nocase; classtype:attempted-recon; sid:200005089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/mynrk6q",nocase; classtype:attempted-recon; sid:200005090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ny0rjd4",nocase; classtype:attempted-recon; sid:200005091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/nynglzu",nocase; classtype:attempted-recon; sid:200005092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/oyqykkh",nocase; classtype:attempted-recon; sid:200005093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ptl7kd8",nocase; classtype:attempted-recon; sid:200005094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/pyqptqe",nocase; classtype:attempted-recon; sid:200005095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/pywuwcj",nocase; classtype:attempted-recon; sid:200005096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/qyc4svc",nocase; classtype:attempted-recon; sid:200005097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/qyjuf4r",nocase; classtype:attempted-recon; sid:200005098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/qymd2vc",nocase; classtype:attempted-recon; sid:200005099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/tyq6jn2",nocase; classtype:attempted-recon; sid:200005100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/uybigpf",nocase; classtype:attempted-recon; sid:200005101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/uydktcc",nocase; classtype:attempted-recon; sid:200005102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/uyqji5z",nocase; classtype:attempted-recon; sid:200005103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/wyc154r",nocase; classtype:attempted-recon; sid:200005104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/xynjuem",nocase; classtype:attempted-recon; sid:200005105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ytv0uzv",nocase; classtype:attempted-recon; sid:200005106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy.tc",nocase; http_uri; content:"/oglp",nocase; classtype:attempted-recon; sid:200005107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d854c624d7.gesundheitundschonheit.com",nocase; http_uri; content:"/#?act=cl&pid=34515_md&uid=1&vid=25&ofid=1615&lid=126&cid=17171",nocase; classtype:attempted-recon; sid:200005108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ddei5-0-ctp.trendmicro.com",nocase; http_uri; content:"/wis/clicktime/v1/query?url=https%3a%2f%2fbit.ly%2f3xbrmiz&amp\;umid=e0d616b6-d1cd-0805-b54d-9e99fb3c7491&amp\;auth=c41c1515baf61de3a931ab1ffc72d6507ac373e9-d6da4393da32c9f106e2f20ecd8a29c66558a728",nocase; classtype:attempted-recon; sid:200005109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"desklegger.com",nocase; http_uri; content:"/?a=2651&amp\;oc=9703&amp\;c=28306&amp\;m=3&amp\;s1=&amp\;s2=david@bott.ca",nocase; classtype:attempted-recon; sid:200005110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dichvuvnpt.com",nocase; http_uri; content:"/home/components/com_user/bbtonline.html",nocase; classtype:attempted-recon; sid:200005111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digisigner.com",nocase; http_uri; content:"/online/showdocument?documentid=1fce937a-ba39-4053-a83a-f07711ad8efd&invitationid=82f3e840-cd11-4da4-8579-304bd7e930b0",nocase; classtype:attempted-recon; sid:200005112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dik.si",nocase; http_uri; content:"/yvftx/",nocase; classtype:attempted-recon; sid:200005113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fedd.huntershub.online%2fedd%2520prepaid%2fprepaid%2f&amp\;key=tqpetxlm09wtvlwulwkm1g",nocase; classtype:attempted-recon; sid:200005114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fwww.rmiembassyus.org%2fmedia%2fjui%2fjs%2f&key=i5eldkzvfyplzuuvh2xytg",nocase; classtype:attempted-recon; sid:200005115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fiuzebu&amp\;key=nicafam8rylqfhugoffa5a",nocase; classtype:attempted-recon; sid:200005116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fvpz1ac&amp\;key=yc94ig4npafy0sthcgmlig",nocase; classtype:attempted-recon; sid:200005117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.adelaidetowingandcarremoval.com.au%2fwp-content%2f%2fuploads%2f2020%2fsocialsecurity%2f&amp\;key=yxyb8swn1zzjw8bcatgrjw######",nocase; classtype:attempted-recon; sid:200005118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.gepard.ru%2flogin%2faccount%2f&key=jgdq7zs0ratd6src39cdig",nocase; classtype:attempted-recon; sid:200005119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dmrstrya.xyz",nocase; http_uri; content:"/login.php?cmd=login_submit&id=d92a484915c7222acf9f1e5dced058a8d92a484915c7222acf9f1e5dced058a8&session=d92a484915c7222acf9f1e5dced058a8d92a484915c7222acf9f1e5dced058a8",nocase; classtype:attempted-recon; sid:200005120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc",nocase; classtype:attempted-recon; sid:200005121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc/",nocase; classtype:attempted-recon; sid:200005122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub",nocase; classtype:attempted-recon; sid:200005123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin",nocase; classtype:attempted-recon; sid:200005124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true",nocase; classtype:attempted-recon; sid:200005125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vts9czxqycsgi-quifs7m1mqjzmlcjlccnhw3dsahdss5ymnpy6y0vsgwvf3piu6js22ydjyew1oyo_/pub?embedded=true",nocase; classtype:attempted-recon; sid:200005126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/12467akksjbdxtns1aefg-fo9hlxamtxynf5brvbz5tc/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200005127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/1fpyjsolbptidxpf23lqom1jghfw7qrvbbbfxxi82pzg/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200005128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform",nocase; classtype:attempted-recon; sid:200005129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc0yyqlieizg0nzouznvhsjfags1h9qi5hpdw3qlgbivm501q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc8uc5aztlek3s6dqtk1etorhez5m2yvubyw5qmfkpisrelcq/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200005131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform",nocase; classtype:attempted-recon; sid:200005133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscc2f9wy8412ndwgxfiimtt08nlzg30g-yt_vx0eooa18ixzw/viewform",nocase; classtype:attempted-recon; sid:200005135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscc30j0zmjvz0ct-wi59yhnz9gimpj3snofe5vkbovmeykomg/viewform",nocase; classtype:attempted-recon; sid:200005136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform",nocase; classtype:attempted-recon; sid:200005137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform",nocase; classtype:attempted-recon; sid:200005138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform",nocase; classtype:attempted-recon; sid:200005139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform",nocase; classtype:attempted-recon; sid:200005141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdkcb2saiqfhtrh2inewegl56-jrv0e_ncfubvdmdprxpzfq/viewform",nocase; classtype:attempted-recon; sid:200005143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscdkcb2saiqfhtrh2inewegl56-jrv0e_ncfubvdmdprxpzfq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform",nocase; classtype:attempted-recon; sid:200005146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform",nocase; classtype:attempted-recon; sid:200005147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsch8_wrvwsg5klxptwjznnmghz9ny516msszkmzzjr6wqll4q/viewform",nocase; classtype:attempted-recon; sid:200005148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook",nocase; classtype:attempted-recon; sid:200005149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscphvypdecdasu-iqnvt4bvkiu5g1fioskjyfi9gk2z69cemq/viewform",nocase; classtype:attempted-recon; sid:200005150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscq8lwf5u5pxklisswjs79fcko1u76xaqw2cplb00uamj2epa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform",nocase; classtype:attempted-recon; sid:200005152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscsp2ltu8y_5h-m0512ckji9i1rwabxoforr5hgbkwi-gx9mg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsct1pxn0qq6ulzzs2kqgekpwoa-galaegxg5mzuxii-fvmwaq/viewform",nocase; classtype:attempted-recon; sid:200005154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform",nocase; classtype:attempted-recon; sid:200005155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscvp9muuu33wgba4h5kugaleeh0onrqzug-b6n5aj5werrmaw/viewform",nocase; classtype:attempted-recon; sid:200005156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscvqmhqgwbubzxdynzgvlbmmziyagdiadz2eyhc-s-ro8ndfq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsczp3nbsyvoj5-wf-7k4xshjczyxvdc-lc679urtbl_k-9x8q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd1x00gqusaavdvp5ualsrctsjb80y9oy7yln6wwani40srpw/viewform",nocase; classtype:attempted-recon; sid:200005160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd1x00gqusaavdvp5ualsrctsjb80y9oy7yln6wwani40srpw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd6h5k1kajgpan-tfvs7w4k_b4wq3m6wjdfh_kfrpiq-3w-ag/viewform?fbzx=8876075289152692257",nocase; classtype:attempted-recon; sid:200005163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628",nocase; classtype:attempted-recon; sid:200005164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd8_xzmknrntxwpeg8bvmvbbzmjsfgejo-vngsmyjx1dnidsg/viewform",nocase; classtype:attempted-recon; sid:200005165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform",nocase; classtype:attempted-recon; sid:200005167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform",nocase; classtype:attempted-recon; sid:200005168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform",nocase; classtype:attempted-recon; sid:200005170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200005171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform",nocase; classtype:attempted-recon; sid:200005173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhr2qehprrqzfimbwtlojynm_nvvsdovser7pmho5v5o4cxw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhyezpletqihy8incmgssiwqjlbqwo03ulvjxipjmjjrrscg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdinjm_qvdbv3roybqi073rm1pujmrrs7lid7c3qk-4xwweew/viewform",nocase; classtype:attempted-recon; sid:200005177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdlwgxgjcqz_53lnvyfaiibnkptndldhs4vd0c__6lufv81zq/viewform",nocase; classtype:attempted-recon; sid:200005178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform",nocase; classtype:attempted-recon; sid:200005179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdnngh7an2vfxw1k7cotxcb24wwne2qcm3j5deelwsn676z2q/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200005181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdp6gmot9lhhgyqmwp6tavohtvtacptly7nzcuiynoir9cjbg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvo-nueiprck-o5gw7-bnmsz9jvwlyspeqfhfr2g2osbsrba/viewform",nocase; classtype:attempted-recon; sid:200005183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform",nocase; classtype:attempted-recon; sid:200005185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdxkjopelrwprbruv5pypgeut5c971mdpwp9w1ndxosaui0oa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdxm-rwnv41p3wdcbtetukrctoakvuoe1h_uy8jgnxy7kldza/viewform",nocase; classtype:attempted-recon; sid:200005188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform",nocase; classtype:attempted-recon; sid:200005189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzpz7mn6te18_1olbnvu14ez5j_lscj_pintnwldwht6wtaq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform",nocase; classtype:attempted-recon; sid:200005191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse2axrxuz4hf-wkps_tryezncrr3zvl_bm9icnltshp5fj60q/viewform",nocase; classtype:attempted-recon; sid:200005192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform",nocase; classtype:attempted-recon; sid:200005193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse5htthgifmniezokiypnjjhanvkvlehsrk9esgcpoauqutiw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse659tcdnppv704bqfgkhuwvmmlufcbpaicqx075d_gxnsqba/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform",nocase; classtype:attempted-recon; sid:200005197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseaoj1gseoc72inocx9jofb1nqgqm81_firdsookdvnd4fz3q/viewform",nocase; classtype:attempted-recon; sid:200005198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform",nocase; classtype:attempted-recon; sid:200005199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseck8-g3um70ihw-ajfait5whcec3qdowobizswz8_-et_jkq/viewform",nocase; classtype:attempted-recon; sid:200005201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseerl98zqhhsjdo_vwhfzft3njmrw-es6isa689uqc2opalkg/viewform",nocase; classtype:attempted-recon; sid:200005202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsefdjhvlb8j4f16k5uewfckrm6sxun7mb8kmt6hnsw4twzb1a/viewform",nocase; classtype:attempted-recon; sid:200005203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsefv5nkokmsxbkw84jsid2gwxxq8hhcvvajj-hjwl43irewza/viewform?vc=0&amp\;c=0&amp\;w=1",nocase; classtype:attempted-recon; sid:200005204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseggxi9u9oxdijtvvfpdkom7-bau-dstzgnovfyndrhxtk_ew/viewform?fbzx=450838898210045776",nocase; classtype:attempted-recon; sid:200005205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform",nocase; classtype:attempted-recon; sid:200005207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseja63wnjv6158neslzqwlnlui4yluhb0nlou-vx0ehpwkexg/viewform",nocase; classtype:attempted-recon; sid:200005208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform",nocase; classtype:attempted-recon; sid:200005209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsel_ki8gcgzajteddl27pbkpo6w90de6hj6epzsurphsvekpg/viewform?embedded=true",nocase; classtype:attempted-recon; sid:200005210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemuphd9zpegybxx9gwrw-vsu9gbqjuufhz2wx34p7cj1cibq/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform",nocase; classtype:attempted-recon; sid:200005213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200005214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform",nocase; classtype:attempted-recon; sid:200005215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform",nocase; classtype:attempted-recon; sid:200005216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsesuqyiwovf64ujl8ewzqpw-vq7_ljhh96vouros2rqn1vunw/viewform",nocase; classtype:attempted-recon; sid:200005217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform",nocase; classtype:attempted-recon; sid:200005218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform",nocase; classtype:attempted-recon; sid:200005220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform",nocase; classtype:attempted-recon; sid:200005221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewymtg0_yxlw9-prz205ldklpt1q0_aklvlput4ndg_coetq/viewform",nocase; classtype:attempted-recon; sid:200005223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsexrthgahyza746esrgvtj4hqnjlqgmef_k2l3usnolt1fjgg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseyedrifg-qlmvdq0o9il9kmr_p85q1giqync2uwgbbi5he1q/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform",nocase; classtype:attempted-recon; sid:200005226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf43dgkrjoe0kbhyqzxvaswkmbstzlu6x-40xi-sxxgfevhww/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf9wlt_kxvre3b2hhpi0hcx4zia83c9bbkabo4w15nfekvwuw/viewform",nocase; classtype:attempted-recon; sid:200005228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform",nocase; classtype:attempted-recon; sid:200005229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfaexmgpgntdkiayu-wg3vbkhus9frurejyqxukiiydkjc3ug/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfanborkr2ivrhpsjdnvnb-jktwkjbuub3wnsxb-md7haddsq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfcadutx0elsh0wfimgfoedkee1p3gr2wf_qnv_ctizw8ztaa/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200005233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsffxdjsibp7kmfd28idwdkvupj3klesiwvpoiecz8xpgdh0cq/viewform",nocase; classtype:attempted-recon; sid:200005235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfgomlcpbyhodks1bwjmx6f5jr0tqwhngun_juf2qk0jp8dbq/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfgrkvxsp4vv3h2jpge8n2rwi_acvt3o91y4av8-nbjpc0xxw/viewform?c=0&amp\;w=1",nocase; classtype:attempted-recon; sid:200005237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfh-impaknvwlynkq8u0tetf0nw-b_3iepqmfkruaso7fb4kq/viewform",nocase; classtype:attempted-recon; sid:200005238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfhzli805cycnlai887dfo6ra8bwbwjbc8uehmv5amiaqdbyq/viewform",nocase; classtype:attempted-recon; sid:200005239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform",nocase; classtype:attempted-recon; sid:200005240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform",nocase; classtype:attempted-recon; sid:200005241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9fn6xlhju27dzlzxp6nzvjlaqbtzb3uf20uakw6ddguvnw/viewform",nocase; classtype:attempted-recon; sid:200005243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9fn6xlhju27dzlzxp6nzvjlaqbtzb3uf20uakw6ddguvnw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform",nocase; classtype:attempted-recon; sid:200005245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfksirdejkit-tdeiwrnkf00ygsqdsqth0hmwydiqdik10tna/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform",nocase; classtype:attempted-recon; sid:200005247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsforgq2zksc0soenei1m7xcow9surjrynoh6ppsku6_kxvdpw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform",nocase; classtype:attempted-recon; sid:200005250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfpvmlfha5uwdz_4bnvq19l2mctpltose6aszym6w9ls0hxza/viewform",nocase; classtype:attempted-recon; sid:200005252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization",nocase; classtype:attempted-recon; sid:200005253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsr_hufaploql8ruxbcya-5su5xpkzee0qtzs6_ixatjrmcw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200005256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvhavjlgw4__-x0qdg5tbot5uo9vkn4csn8mx3lpvkdah8ag/viewform",nocase; classtype:attempted-recon; sid:200005259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvvvnddwmy-3u-agx0bvar5wfmplx8bvgef_zdia7ra9llfg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200005260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwbcfrxuktidm2ctjalngebxbx4k_dijxbekg2y-naausaqw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200005261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform",nocase; classtype:attempted-recon; sid:200005262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfygwrauuzg0kcnd6w_s42qneyhqpha0zs1rift0akntmlugq/viewform",nocase; classtype:attempted-recon; sid:200005263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p",nocase; classtype:attempted-recon; sid:200005264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/viewerng/viewer?url=proxy.ge.tt/1/files/5d0k9lx2/0/blob?referrer%3duser-a6kjrvmdexz9favkffsdh44k4iybrxak3pn41u-%26pdf&amp\;ddrp=1=secured",nocase; classtype:attempted-recon; sid:200005265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dolcevitabymerit.com",nocase; http_uri; content:"/exchange328e91ec88ae4615bbc38ab6ce41104e/jspuser328e91ec88ae4615bbc38ab6ce41107e/?08a3ea=brian_casey@capgroup.com",nocase; classtype:attempted-recon; sid:200005266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit",nocase; classtype:attempted-recon; sid:200005267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200005268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe",nocase; classtype:attempted-recon; sid:200005269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cc4iizuwctob05muvpmydl-rruxdfimu/edit",nocase; classtype:attempted-recon; sid:200005270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cppgzjnodnftsks_w82um_b_ctgzn-ah/edit",nocase; classtype:attempted-recon; sid:200005271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cvc0ts0fkrsyx6vnnuypmotnh7jkcsln/edit",nocase; classtype:attempted-recon; sid:200005272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200005273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fsvmjkcq7ennrsfdufkcxshfhnda_fui/view",nocase; classtype:attempted-recon; sid:200005274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui",nocase; classtype:attempted-recon; sid:200005275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view",nocase; classtype:attempted-recon; sid:200005276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view",nocase; classtype:attempted-recon; sid:200005277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jvfh6wq9ea9kxr1shhwbh3pecflqzppc/edit",nocase; classtype:attempted-recon; sid:200005278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1mg5asnyoeet7qsg2n0d_2paxc3j7wx3k/edit",nocase; classtype:attempted-recon; sid:200005279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view",nocase; classtype:attempted-recon; sid:200005280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit",nocase; classtype:attempted-recon; sid:200005281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1xpjy2kxsljvynrhgntllyzgvlzfxmvuc/view?usp=sharing",nocase; classtype:attempted-recon; sid:200005282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1zmjm3f6e-mgx8ev829md4mxxyd300nbb",nocase; classtype:attempted-recon; sid:200005283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; http_uri; content:"/wp-content/plugins/alldomain/domain/dmain/index.php?i=i&amp\;0=abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200005284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecusltd-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/angela_ure_ecusltd_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=umwosbguhwaqic3hhtqfly7zjwf8oggrcn6d%2bggohoc%3d&docid=1_1956f6e254d71417a89981b2a1c8d0a99&wdformid=%7be61ca4f5-c461-425a-a52e-4598e7b699e5%7d&action=formsubmit&cid=4ab9a2a7-7cf4-43ae-8149-ffead8d66e7b",nocase; classtype:attempted-recon; sid:200005285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eeoeoleoeea.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eeverywhere-my.sharepoint.com",nocase; http_uri; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn",nocase; classtype:attempted-recon; sid:200005287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eliotecae-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/subind_eliotec_ae/_layouts/15/wopiframe.aspx?guestaccesstoken=akowbwdwm%2f15ep8zswuw1id0vmpqmkm3vc4jwvddirw%3d&docid=1_1b124a04726944c449498756807aaae31&wdformid=%7b4d4710fa%2d1101%2d4c23%2d9580%2d7cce85e183be%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmeform.com",nocase; http_uri; content:"/builder/form/f9u1s4b5dfa5rfvgpn2fe25y/",nocase; classtype:attempted-recon; sid:200005289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmeform.com",nocase; http_uri; content:"/builder/form/rn6bf7v0znavp58",nocase; classtype:attempted-recon; sid:200005290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eposcard.co.jp",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200005291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9 sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%2bsjfgzhadhvte2gyowjf83iqbjrjehik4s%3d&docid=1_135f7008dfbfa44e6b09dab0eb165b997&wdformid=%7be037f2d9%2d5daa%2d4916%2dba03%2deb11d0aa6dea%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eswissch.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eurobankovnikredit.com",nocase; http_uri; content:"/?fbclid=iwar3cu_8pblosqw-rwa7evcrs5jpl6zvzkou0qrf7vl9oqge4h2ctmcxrdyk",nocase; classtype:attempted-recon; sid:200005297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventsinamerica.com",nocase; http_uri; content:"/eia-mobile/app/tracking-die/inbox/account/ifram/index.php",nocase; classtype:attempted-recon; sid:200005298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail",nocase; classtype:attempted-recon; sid:200005299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=483c5f32-f1b7-7c70-925c-47f2705bab52&notekey=911c810bd15ccbd1f19fba1c3e4cc4d5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f483c5f32-f1b7-7c70-925c-47f2705bab52%2f911c810bd15ccbd1f19fba1c3e4cc4d5&title=you%2bhave%2breceived%2ban%2binvoice",nocase; classtype:attempted-recon; sid:200005300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice.",nocase; classtype:attempted-recon; sid:200005301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/483c5f32-f1b7-7c70-925c-47f2705bab52/911c810bd15ccbd1f19fba1c3e4cc4d5",nocase; classtype:attempted-recon; sid:200005302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5",nocase; classtype:attempted-recon; sid:200005303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s672/client/snv?noteguid=b30b4b36-5bf9-846c-0577-bbb0c4439efc&notekey=2f0f6f89194031fabbc3b4a455071a64&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs672%2fsh%2fb30b4b36-5bf9-846c-0577-bbb0c4439efc%2f2f0f6f89194031fabbc3b4a455071a64&title=microsoft%2boffice365",nocase; classtype:attempted-recon; sid:200005304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s740/client/snv?noteguid=6dd4c982-2f3f-7d83-4e18-5e028127e7d1&notekey=399d3f6c5e422fb90527fefea85cfc44&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs740%2fsh%2f6dd4c982-2f3f-7d83-4e18-5e028127e7d1%2f399d3f6c5e422fb90527fefea85cfc44&title=initial%2bpage",nocase; classtype:attempted-recon; sid:200005305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everythingmobilelimited-my.sharepoint.com",nocase; http_uri; content:"/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/_layouts/15/onedrive.aspx",nocase; classtype:attempted-recon; sid:200005306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excelelectrical0-my.sharepoint.com",nocase; http_uri; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn",nocase; classtype:attempted-recon; sid:200005307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"explorebathurst.com.au",nocase; http_uri; content:"/rrefeeieoj.html?erectrcsq@*cthiytvcdx$zsxycuikjmkjivee$terdtygjyvtrre",nocase; classtype:attempted-recon; sid:200005308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fanlink.to",nocase; http_uri; content:"/gfx6?cmca?=",nocase; classtype:attempted-recon; sid:200005309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fasthost.hk",nocase; http_uri; content:"/assets/redirect-auth.html",nocase; classtype:attempted-recon; sid:200005310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php",nocase; classtype:attempted-recon; sid:200005311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php...",nocase; classtype:attempted-recon; sid:200005312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fclighting.sharepoint.com",nocase; http_uri; content:"/:x:/r/customercare/_layouts/15/wopiframe.aspx?guestaccesstoken=ce%2fd5uzxeu8hlntd6e5v18nttv4whxgmlwyudt4igom%3d&docid=1_1eb5df03726a240859b223a44b8b16724&wdformid=%7bb8008e00-21bc-4a4a-91dc-1e1b63610c96%7d&action=formsubmit&cid=c766f7bd-9562-4c9e-a9b0-75cf38b33e48",nocase; classtype:attempted-recon; sid:200005313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/muejft/~3/ycyn6gnet0k/warehousing.php",nocase; classtype:attempted-recon; sid:200005314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/spqgxlzjlss/~3/byf895vf6tk/nutrition.php",nocase; classtype:attempted-recon; sid:200005315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feeds.feedburner.com",nocase; http_uri; content:"/investorway",nocase; classtype:attempted-recon; sid:200005316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ferferfrefe.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifit.co.uk",nocase; http_uri; content:"/jelxwqrcrvhj&amp\;ijosing&amp\;kontakt@wmb-walther.de.html",nocase; classtype:attempted-recon; sid:200005318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200005319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/a-zeio-reioz-522.appspot.com/o/indexxxv%25454%255.html?alt=media&token=b24a87c2-7467-451e-a100-3d31fa46a743#winnie@soupro.com",nocase; classtype:attempted-recon; sid:200005320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/achproject509353-i353-3ih5f-10.appspot.com/o/achbf-vye-ur-g8%252fbv-ebry-8g%252fbf-vye-ur-g8%252fbv-ebry-8g%25%40fabf-vye-ur-g8%252fbv-ebry-8g10.html?alt=media&amp\;token=cf886132-ee55-43e8-9d0f-a6dbb7ba590a#",nocase; classtype:attempted-recon; sid:200005321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/armaoffices.appspot.com/o/fdsklxrsqgdkqrwszsprjmbwtftqgpthwjwqjvvzscstgnmcvbblfcbcgwzjjbt.htm?alt=media&token=e3feec53-9d57-4eff-9b7a-d58e91e54d4c#user@domain.com",nocase; classtype:attempted-recon; sid:200005322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/biyugbhiuhgy7o900-h9oh98h9-987.appspot.com/o/vnmbvuyt8-8y98yh0%3d890y8iuh9yyh%2f5rtyfghtfyu67-9876trfc%3d9ygv.htm?alt=media&amp\;token=dce6f041-19ff-4e8a-8012-1cfdac4cf369#bv@pplsi.com",nocase; classtype:attempted-recon; sid:200005323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bmvfhjewter358bsvgtst.appspot.com/o/!%40%25%24%23ohow2%26%25%26%24%23!%23%24!.html?alt=media&amp\;token=a7216a8f-9691-45b2-9775-693dd99503e8#randyharp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bnnnnnn-2133f.appspot.com/o/sboy.htm?alt=media&token=4b58a3ec-3a18-4152-a41f-55a89a34d017&login",nocase; classtype:attempted-recon; sid:200005325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bol1811gens97-1acdc.appspot.com/o/%5c%5cbol1811gens97%2f%5c%5cbol1811%2fbol1811gen.html?alt=media&token=6d87c6ba-b83a-4457-ab40-4396840d735b",nocase; classtype:attempted-recon; sid:200005326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bus0607clougensatem.appspot.com/o/bus0607clougen%2findex2bus0607447d066cb774.html?alt=media&amp\;token=5baac3e2-5da8-4153-86b4-8971a2ac5892#banko@10acrewood.com",nocase; classtype:attempted-recon; sid:200005327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/car2-2004crgpng.appspot.com/o/index2ibicar.html?alt=media&amp\;token=9c9647f6-f132-4e13-8ad4-c44765b9133e#abuse@google.com",nocase; classtype:attempted-recon; sid:200005328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#reima.helminen@utu.fi",nocase; classtype:attempted-recon; sid:200005329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#service.itz@zhdk.ch",nocase; classtype:attempted-recon; sid:200005330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dam3005genwtbgfam.appspot.com/o/reddam0806%2flag0806famegen-040447d066cb774f1.html?alt=media&amp\;token=f1dd8ee6-33f2-4149-93f7-3db577373528#dickfleming@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dfhdskfkgkrgr8zrhrthrdrdh.appspot.com/o/!%23%24%26%25%24%23bn3%23%24!%26%25%24.html?alt=media&amp\;token=311bb9c7-ae6f-40e9-96e3-a06e7bccfa0e#viestinta@utu.fi",nocase; classtype:attempted-recon; sid:200005332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr",nocase; classtype:attempted-recon; sid:200005333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com",nocase; classtype:attempted-recon; sid:200005334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ee-orex-eire-581.appspot.com/o/webmail-welcome-to-webmail.html?alt=media&amp\;token=6fa19c2c-b2cd-478d-bbf0-6092db00e352#@yorku.ca",nocase; classtype:attempted-recon; sid:200005335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/goo2-ac630.appspot.com/o/goo (2).html?alt=media&amp\;token=2d1281a2-3364-420f-a3b5-c693b7bda1f2#a@b.com",nocase; classtype:attempted-recon; sid:200005336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/gredor-intlwebpoint.appspot.com/o/incexiui8uh.html?alt=media&amp\;token=d7e2191e-cde5-4233-a67b-14f3d7d58f56#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200005337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/gsdffdwatdfwdadddadsgd.appspot.com/o/!%23%24%40%26buli%24!%40%26!%40%23%24!%26.html?alt=media&amp\;token=110228a1-3566-41ef-b241-427ad3b25a9f#aaronfredricks@legalshield.com",nocase; classtype:attempted-recon; sid:200005338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hing9-f9bc0.appspot.com/o/hi1 (9).html?alt=media&amp\;token=0d56c7d7-2e03-41f5-b764-4473f0ad4d51#a@b.com",nocase; classtype:attempted-recon; sid:200005339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hutobonmu7g.appspot.com/o/butokilopo.html?alt=media&token=6b98d9bd-5513-45d3-ab8a-e46571a70ee4#user@example.org",nocase; classtype:attempted-recon; sid:200005340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932",nocase; classtype:attempted-recon; sid:200005341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932#raymondtripp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/macryti-109.appspot.com/o/kp-oe0%2fbtt-hash.html?alt=media&amp\;token=02abe8bd-5141-4b5a-a7d4-08120e5f43dd#choiteng@motenghaiplc.com",nocase; classtype:attempted-recon; sid:200005343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mail9-e6376.appspot.com/o/index.html?alt=media&amp\;token=f619a1f5-b1a4-4b63-9d00-6df1874c4b1b#memberservices@legalshield.com",nocase; classtype:attempted-recon; sid:200005344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&amp\;token=420caa32-915f-40c5-86a6-28ada5625a7a&amp\;prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200005345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&token=420caa32-915f-40c5-86a6-28ada5625a7a&prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200005346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mic-apps03629.appspot.com/o/index.html?alt=media&token=d9f4f11c-e123-4b2b-8cba-b4f3f3541786#peterawl@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mon-office.appspot.com/o/mscsq1-t-check-packet.htm?alt=media&token=72ab1aeb-a7a9-4a84-9852-099a56ca500e#dxnlckblegftcgxllm9yzw",nocase; classtype:attempted-recon; sid:200005348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ntachi-e1dbe.appspot.com/o/hgigieiciejceinhviejrie95489349%20(19).html?alt=media&amp\;token=5901e369-e71e-416b-9688-b21c62e31587#m.couvee@colasit.nl",nocase; classtype:attempted-recon; sid:200005349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/nwndara-fc6ab.appspot.com/o/nwdaacp%2fsfgdert.html?alt=media&amp\;token=4f242e6b-7f26-4888-b593-19ef4bf43fa7#rentals@steinborn.com",nocase; classtype:attempted-recon; sid:200005350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/on1rt-44071.appspot.com/o/index.html?alt=media&token=0d469e93-836b-4af8-b206-16a5d882d556#abuse@fasthosts.com",nocase; classtype:attempted-recon; sid:200005351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200005352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200005353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.de",nocase; classtype:attempted-recon; sid:200005354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.test",nocase; classtype:attempted-recon; sid:200005355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200005356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#landman56@att.net",nocase; classtype:attempted-recon; sid:200005357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#sdeco@prodigy.net",nocase; classtype:attempted-recon; sid:200005358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/tb%2findex.htm?alt=media&amp\;token=8176e96d-c102-4018-9888-17d4dec8d489#",nocase; classtype:attempted-recon; sid:200005359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200005360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt",nocase; classtype:attempted-recon; sid:200005361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/project-f68e7.appspot.com/o/klks.html?alt=media&token=1beb01dc-3574-447c-b8f1-e0d2316795a0#bonita@soupro.com",nocase; classtype:attempted-recon; sid:200005362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com",nocase; classtype:attempted-recon; sid:200005363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#support@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200005364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200005365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/trows9098.appspot.com/o/25%255e%2524%2523%2540.html?alt=media&amp\;token=51dbb7d7-54ca-47bb-bbfc-f03691ac3d14&amp\;utm_medium=marketing&amp\;%24web_only=true&amp\;_branch_match_id=716254997194823397#samba@jubileegroup.co.uk",nocase; classtype:attempted-recon; sid:200005367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tu-03yg-3yhg-3yh4g-93h4g-h.appspot.com/o/wrjfgbho3429uy-03294y-gf93hgf-9y%2f30t49u30-tu-3hg3hg-39g-jug.html?alt=media&amp\;token=a35ff937-2752-4bdc-b4fe-da15853821c5#jtucker@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/updatess-9a650.appspot.com/o/index.html?alt=media&amp\;token=7be8eeaf-2217-40c7-9504-4e8118de2618#example@example.com",nocase; classtype:attempted-recon; sid:200005369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/updatess-9a650.appspot.com/o/index.html?alt=media&token=7be8eeaf-2217-40c7-9504-4e8118de2618#example@example.com",nocase; classtype:attempted-recon; sid:200005370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/user3987267105468.appspot.com/o/a1%2findex.htm?alt=media&amp\;token=0ea51307-7b68-4058-abb5-4d7006478527#test@example.com",nocase; classtype:attempted-recon; sid:200005371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wacvuipqa-wavaddiom.appspot.com/o/cvaysfgysy.html?alt=media&amp\;token=faaf3715-8974-4f79-a92e-e788c6d97995#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200005372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wacvuipqa-wavaddiom.appspot.com/o/cvaysfgysy.html?alt=media&token=faaf3715-8974-4f79-a92e-e788c6d97995#email@domain.com",nocase; classtype:attempted-recon; sid:200005373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wdrhghxlcnwtjkjltmrtztqlh.appspot.com/o/celibacy - copy (7).html?alt=media&amp\;token=30c670b1-9299-45c6-a16b-5bd1037c4499#@yorku.ca",nocase; classtype:attempted-recon; sid:200005374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xn-nerio-reioz-481.appspot.com/o/indexxxv%25454%255.html?alt=media&amp\;token=ce2be12b-3c3d-42df-adb4-e246fa16b9c2#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200005375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ze-nerio-reoz-447.appspot.com/o/indexxxv3534.html?alt=media&amp\;token=147ed254-cb63-40a9-aca6-9e544f1929f1#abuse@uregina.ca",nocase; classtype:attempted-recon; sid:200005376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flavena.co.rs",nocase; http_uri; content:"/mc.html",nocase; classtype:attempted-recon; sid:200005377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flow.page",nocase; http_uri; content:"/btml",nocase; classtype:attempted-recon; sid:200005378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/p/ckk13mrg1?fc=0",nocase; classtype:attempted-recon; sid:200005379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/p/cldvsqn6z?fc=0",nocase; classtype:attempted-recon; sid:200005380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9j2",nocase; classtype:attempted-recon; sid:200005381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9jg",nocase; classtype:attempted-recon; sid:200005382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/5884980",nocase; classtype:attempted-recon; sid:200005383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/6015526/my-form",nocase; classtype:attempted-recon; sid:200005384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/6027380/form",nocase; classtype:attempted-recon; sid:200005385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/6035211/form",nocase; classtype:attempted-recon; sid:200005386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.asana.com",nocase; http_uri; content:"/?k=cdxmabdeiqp1ls8o45yzlw&amp\;d=1200547430279636",nocase; classtype:attempted-recon; sid:200005387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/19fzdjrlxxquwqpf7",nocase; classtype:attempted-recon; sid:200005388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/1mqqu8exzgpptqpl8",nocase; classtype:attempted-recon; sid:200005389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/3cyoxmwxqkbfpt2v5",nocase; classtype:attempted-recon; sid:200005390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/8epxhwdapiab7mfw7",nocase; classtype:attempted-recon; sid:200005391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/9bwawhpz5vi7ilpe6",nocase; classtype:attempted-recon; sid:200005392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/akohiguxjs9wlpu28?sllqm",nocase; classtype:attempted-recon; sid:200005393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/b7lqaal42juffiw1a",nocase; classtype:attempted-recon; sid:200005394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/bfz2l7i3wvrp5heb9",nocase; classtype:attempted-recon; sid:200005395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/dncj4btc56n1n71n8",nocase; classtype:attempted-recon; sid:200005396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/edtu6r7rqxqyegcf6",nocase; classtype:attempted-recon; sid:200005397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/egj66jkgwkcd3aat8",nocase; classtype:attempted-recon; sid:200005398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/eozlrnnf7jh84xdp8",nocase; classtype:attempted-recon; sid:200005399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx",nocase; classtype:attempted-recon; sid:200005400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/goerpntl5tfeumdz6",nocase; classtype:attempted-recon; sid:200005401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gr4b9sxradtcj7or7",nocase; classtype:attempted-recon; sid:200005402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/guptjarp2xatzbvo8",nocase; classtype:attempted-recon; sid:200005403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/iai7pzm4pxyb145i9",nocase; classtype:attempted-recon; sid:200005404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp",nocase; classtype:attempted-recon; sid:200005405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jzxtb9auexgjcewfa",nocase; classtype:attempted-recon; sid:200005406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/kehch96avaku7oey7?akowgmooutpwa",nocase; classtype:attempted-recon; sid:200005407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/nvljeb1quzaovd8u5",nocase; classtype:attempted-recon; sid:200005408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd",nocase; classtype:attempted-recon; sid:200005409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/qhwastfqxg1yehi77",nocase; classtype:attempted-recon; sid:200005410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/qzopkn9aj2gzaw2g6",nocase; classtype:attempted-recon; sid:200005411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/ruaxzqjjzghi8rar9",nocase; classtype:attempted-recon; sid:200005412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/rwpcmhm8vtfa7f4m8",nocase; classtype:attempted-recon; sid:200005413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/sj21ehdebhkcpvfv6",nocase; classtype:attempted-recon; sid:200005414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/smufgmyhduckbq6ka?fjxhgyroek",nocase; classtype:attempted-recon; sid:200005415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/uqzzznxv4cfhu3yr9",nocase; classtype:attempted-recon; sid:200005416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/v5xtnywt5s6zvpp27",nocase; classtype:attempted-recon; sid:200005417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/v7k2chwbcca59vz27",nocase; classtype:attempted-recon; sid:200005418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/w6uh9p66tdq6l1m66",nocase; classtype:attempted-recon; sid:200005419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/wqycsyy8jhuhvaex7",nocase; classtype:attempted-recon; sid:200005420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x3aasffazsrl8pcr9",nocase; classtype:attempted-recon; sid:200005421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x8hybjggubfftabw8",nocase; classtype:attempted-recon; sid:200005422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/xxccjhuzjtg4pr3y8",nocase; classtype:attempted-recon; sid:200005423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/xxjqmu6luzkpnalg6",nocase; classtype:attempted-recon; sid:200005424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/yfxkceytox2zuyvb6",nocase; classtype:attempted-recon; sid:200005425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=3syn-1cchkavxgboptj0hevjly0merbjkz3gprj_t75un1ltuvezqla2wudrnlltmtbqs0q3mlvfti4u",nocase; classtype:attempted-recon; sid:200005426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=60hhzfbtoe-qdzpnyrluyo-ivxb0mexgqufvg5tcyifunzg5uknzne1irjzvt1y3slewrepwnflmvs4u",nocase; classtype:attempted-recon; sid:200005427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u",nocase; classtype:attempted-recon; sid:200005428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u",nocase; classtype:attempted-recon; sid:200005429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u",nocase; classtype:attempted-recon; sid:200005430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fra1.digitaloceanspaces.com",nocase; http_uri; content:"/gmaingt/server.html",nocase; classtype:attempted-recon; sid:200005431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fra1.digitaloceanspaces.com",nocase; http_uri; content:"/jjdjkddk/micro.html",nocase; classtype:attempted-recon; sid:200005432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frdezeredaresafin.blogspot.com",nocase; http_uri; content:"/?m&#61\;0",nocase; classtype:attempted-recon; sid:200005433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/d83e97792d12108/region.php?particulier",nocase; classtype:attempted-recon; sid:200005434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/jeff_fsstrading_com/ec1yk-fkwzlkst3oymd07zsbczspqpfzu5xd2yuha-cdkq?e=4:u3zdsc&amp\;",nocase; classtype:attempted-recon; sid:200005435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lptfsymt5qzfymlvn",nocase; classtype:attempted-recon; sid:200005436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpw5vumzpbezxmlvn",nocase; classtype:attempted-recon; sid:200005437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxoyofnswww0mlvn",nocase; classtype:attempted-recon; sid:200005438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxz4zdjpwww0mlvn",nocase; classtype:attempted-recon; sid:200005439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/interbank-service",nocase; classtype:attempted-recon; sid:200005440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/validar-ingreso",nocase; classtype:attempted-recon; sid:200005441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/wg4oc",nocase; classtype:attempted-recon; sid:200005442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gisunit.com",nocase; http_uri; content:"/swiss/swiss/swiss/",nocase; classtype:attempted-recon; sid:200005443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200005444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe2.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200005445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glotusinvestment.com",nocase; http_uri; content:"/w/v1/index.html#[email%c2%a0protected]",nocase; classtype:attempted-recon; sid:200005446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fewn4zq5fegh6bf3qpasy44v&amp\;persistence=1&amp\;checksum=3d7975c121a1d514f1b3a9facb177a78f25e1326da6497ae9cf35e33ba436119",nocase; classtype:attempted-recon; sid:200005447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fewn4zx501vbg1xj6vr2hk10&amp\;persistence=1&amp\;checksum=fc555be29c86e6e13177069b7632770b2cb9f30b36d229624f37be1cb2475704",nocase; classtype:attempted-recon; sid:200005448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fexfpq10qje7acrftnz6v4zb&amp\;persistence=1&amp\;checksum=5916a09fb5c03e4187a58ae7221dbc20e8568b5840df4b6f3eb57227975bd2ce",nocase; classtype:attempted-recon; sid:200005449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fey1pewqgha9bqebgbvwe95n&amp\;persistence=1&amp\;checksum=3fefba73b68799e5152bf7031ce8a7b1a300456243ee123a27f6efca31d9f055",nocase; classtype:attempted-recon; sid:200005450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fez46yyrvh6f0bbehn8h419h&amp\;persistence=1&amp\;checksum=069f46345ac935567ad562a3d64a332066064c97f8feae803d555f9cc820c561",nocase; classtype:attempted-recon; sid:200005451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fezncfbjbj86yneatjn0qvt4&amp\;persistence=1&amp\;checksum=8142350e161acc6cb246be1d05d596973a1d3ac50af1f3594ee9ea462c87a4ef",nocase; classtype:attempted-recon; sid:200005452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff06m6n2q43m6zcaqrh8xpm2&amp\;persistence=1&amp\;checksum=26e140f8abae23dd0c8dd547390a4deb9fc54b1acf3539d8aa44fb19e04902ef",nocase; classtype:attempted-recon; sid:200005453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.skimresources.com",nocase; http_uri; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff0qxy635yfpkrdaxav47j5k&amp\;persistence=1&amp\;checksum=cb2e0f7328d6ffea0e15a24046095a0bb98d27d4488e822bea4b181763f2eb0b",nocase; classtype:attempted-recon; sid:200005454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.gl",nocase; http_uri; content:"/yozuaz",nocase; classtype:attempted-recon; sid:200005455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.su",nocase; http_uri; content:"/page/about",nocase; classtype:attempted-recon; sid:200005456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?hl=en-us&q=http://3214003.remaxcapitals.com/&sa=d&source=meet&ust=1624122560720000&usg=afqjcnhwftmstoowfxkgstiqfgifukkveq",nocase; classtype:attempted-recon; sid:200005457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http%3a%2f%2fbit.do%2ffr6ci&sa=d&sntz=1&usg=afqjcne7joz-iz-adrzkrxcihj8t9fs9qw",nocase; classtype:attempted-recon; sid:200005458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http%3a%2f%2fbit.do%2ffsgjq&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngvqc30z-4hiaizv03gpwblwu3vnw",nocase; classtype:attempted-recon; sid:200005459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http://srv-auth.web.app/upd/index.html%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1607952068298000&amp\;usg=afqjcnet34jepejaewvja8unv7ycds1vjg",nocase; classtype:attempted-recon; sid:200005460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://393512dfd8544c98be9a40f2f67df8bd.svc.dynamics.com/t/r/a7uua5shyiplufx4zj7f6u2clgtguiagoxngfoio4am?clientid%3d70000%23%5bemail%5d%2b00-70000&amp\;source=gmail&amp\;ust=1636719774661000&amp\;usg=aovvaw2fsk8htfwhsfqapvbu674n",nocase; classtype:attempted-recon; sid:200005461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://chungcuvinhomessmartcity.com.vn/wp-content/fan/update/update/index.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1601526775264000&amp\;usg=afqjcnh2cow19dlgy8epljp37gqo0awthw",nocase; classtype:attempted-recon; sid:200005462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://duodanseclub.fr//nh/rd/logon/?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1593678623293000&amp\;usg=afqjcnhq3h-kf1tmy7iq1nwza8yz6k4xmq",nocase; classtype:attempted-recon; sid:200005463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://firebasestorage.googleapis.com/v0/b/bmf1406rplpil.appspot.com/o/bmf1406replpil%252findex2bmf0306famegen-040447d066cb774f1.html?alt%3dmedia%26token%3d2205d63d-f15d-4f03-b27a-a81b473b81a4%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1625561695699000&amp\;usg=afqjcnhdvz1aajb9caf_hdl5vkxquj0iog",nocase; classtype:attempted-recon; sid:200005464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://passionfruit4576261.brizy.site/&amp\;source=gmail&amp\;ust=1608664764243000&amp\;usg=afqjcnghljnr1tyn8j4c1ijid09ra9ehdq",nocase; classtype:attempted-recon; sid:200005465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://us4-usndr.com/ru/mail_link_tracker?hash%3d6k5ar5ciusdx1q1tdgm8atcrexmonyy3xdfiogu7zr6gb6gtthpqk7fm8tz4gzkjftg9oouu31eqdro67dtgwnn5x1p3ziiieq8rykja%26url%3dahr0chm6ly90lm1ll2fhegnvbw11bml0eq~~%26uid%3dndmwndy3nw~~%26ucs%3dd93ed45d47070739243d9b678dd03e93&amp\;source=gmail&amp\;ust=1607288611770000&amp\;usg=afqjcngo5kdwx08p-bg6mzdtluzdjhtzxw",nocase; classtype:attempted-recon; sid:200005466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=d&q=https://appengine.google.com/_ah/logout?continue=https://hangouts.google.com/linkredirect?dest=https://schwarz.id.au/recipe//wp-content/--/https:/retail.santander.co.uk/?cliente=ardellasmith@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewjvtam1_9dwahxjpj4khyndc-yqfjaaegqibxad&url=https%3a%2f%2fvzk.co.za%2f&usg=aovvaw1jap4fxa7zb0pnmzjp351q",nocase; classtype:attempted-recon; sid:200005468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/fp?u=https://tinyurl.com/32xz989f&grqid=zbk35vud&s=1&hl=id-id",nocase; classtype:attempted-recon; sid:200005469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=5cee2623.shared-excel-f0ssozzz.pages.dev?shared=byrdww1@widomaker.com",nocase; classtype:attempted-recon; sid:200005470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com",nocase; classtype:attempted-recon; sid:200005471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com",nocase; classtype:attempted-recon; sid:200005472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gormanusa-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gradcracker.com",nocase; http_uri; content:"/out/408?jobid=29207&u=princed.de?id=8400239909",nocase; classtype:attempted-recon; sid:200005474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gstsolutions.online",nocase; http_uri; content:"/404/doesz/col/load.php?0=c2fuzy1tew91bmcucgfya0bmyxvyzwnpys5jb20=&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200005475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gstsolutions.online",nocase; http_uri; content:"/webmass/doesz/col/load.php?0=cmvuaml0ac5jagfuzhjhbkbjyw5wywnrlmnvbq==&amp\;guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&amp\;guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5enc",nocase; classtype:attempted-recon; sid:200005476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; http_uri; content:"/oo/china/?login=amachinist@icmtalent.com",nocase; classtype:attempted-recon; sid:200005477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/1kzic",nocase; classtype:attempted-recon; sid:200005478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/4ds15",nocase; classtype:attempted-recon; sid:200005479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/6qnhc",nocase; classtype:attempted-recon; sid:200005480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/dghpp",nocase; classtype:attempted-recon; sid:200005481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/f1itl",nocase; classtype:attempted-recon; sid:200005482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/fmjiu",nocase; classtype:attempted-recon; sid:200005483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/g9yl5",nocase; classtype:attempted-recon; sid:200005484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/i51rh",nocase; classtype:attempted-recon; sid:200005485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/lmiyt",nocase; classtype:attempted-recon; sid:200005486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/m8ikv",nocase; classtype:attempted-recon; sid:200005487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/o0ugq",nocase; classtype:attempted-recon; sid:200005488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/ta0lq",nocase; classtype:attempted-recon; sid:200005489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/ue2ho",nocase; classtype:attempted-recon; sid:200005490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/urq2m",nocase; classtype:attempted-recon; sid:200005491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/vfywl",nocase; classtype:attempted-recon; sid:200005492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/w27iz",nocase; classtype:attempted-recon; sid:200005493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/xegru",nocase; classtype:attempted-recon; sid:200005494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"han.gl",nocase; http_uri; content:"/zlbow",nocase; classtype:attempted-recon; sid:200005495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hangouts.google.com",nocase; http_uri; content:"/linkredirect?dest=https://maxsushi.com.br/hay/wp-admin/network/banco-santander/home/particulares.php",nocase; classtype:attempted-recon; sid:200005496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"harrisonk12msus-my.sharepoint.com",nocase; http_uri; content:"/personal/kwawrek_harrison_k12_ms_us/_layouts/15/wopiframe2.aspx?sourcedoc={a34fc0e4-2e3b-42d1-ad85-1863c29f8bf8}&amp\;action=default&amp\;originalpath=ahr0chm6ly9oyxjyaxnvbmsxmm1zdxmtbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwva3dhd3jla19oyxjyaxnvbl9rmtjfbxnfdxmvrxvuqvq2ttdmdezdcllvwvk4s2zpx2dcn2vkvthfavvvoxr4dje0m1rvae9fqt9ydgltzt1usjyyoufsndewzw",nocase; classtype:attempted-recon; sid:200005497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heaterintwintersz.ams3.digitaloceanspaces.com",nocase; http_uri; content:"/yuhgbfvdfvbtytrvdfbgt.html",nocase; classtype:attempted-recon; sid:200005498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"held-messages-release-portal.ams3.digitaloceanspaces.com",nocase; http_uri; content:"/v01iebe3vicvgiro1fieviexv4sbdve1r03f.html",nocase; classtype:attempted-recon; sid:200005499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks",nocase; classtype:attempted-recon; sid:200005500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks/",nocase; classtype:attempted-recon; sid:200005501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgevent.com/",nocase; classtype:attempted-recon; sid:200005502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink",nocase; classtype:attempted-recon; sid:200005503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink/",nocase; classtype:attempted-recon; sid:200005504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homeentertainmentexpo.com",nocase; http_uri; content:"/zeland.html",nocase; classtype:attempted-recon; sid:200005505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homefairbd.com",nocase; http_uri; content:"/smi.cers/bmss.php",nocase; classtype:attempted-recon; sid:200005506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homefairbd.com",nocase; http_uri; content:"/smi.cers/login.jsp.php",nocase; classtype:attempted-recon; sid:200005507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotm.art",nocase; http_uri; content:"/in7w3d1",nocase; classtype:attempted-recon; sid:200005508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"house18.info",nocase; http_uri; content:"/themes/engines/ira.xml",nocase; classtype:attempted-recon; sid:200005509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200005510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200005511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200005512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200005513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''",nocase; classtype:attempted-recon; sid:200005514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200005525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200005526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpnepgnmwrgdrrsdshzrvyirlx-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200005527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?http://mercaioldogndi.xyz/login.php",nocase; classtype:attempted-recon; sid:200005528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?http://meroaaialzatdo.xyz/login.php",nocase; classtype:attempted-recon; sid:200005529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://alqaherapharmacy.com",nocase; classtype:attempted-recon; sid:200005530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://www.rkat2.2r-p.xyz/",nocase; classtype:attempted-recon; sid:200005531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://ykm.de/f4b990c239777330",nocase; classtype:attempted-recon; sid:200005532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https:/gymcci.com/?ebay.de/signin&usingssl=1&puserid=&co_partnerid=2&siteid=77&ru=https:/contact.ebay.de/ws/ebayisapi.dll?m2mcontact&item=164305393996&ul_noapp=true&self=howill99&redirect=0&qid=2735945043019&requested=gompalla&guest=1&pagetype=2725",nocase; classtype:attempted-recon; sid:200005533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li?https:",nocase; http_uri; content:"//ykm.de/f4b990c239777330",nocase; classtype:attempted-recon; sid:200005534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/hgav30ruohf",nocase; classtype:attempted-recon; sid:200005535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/shoh30rwmdj?10/13/2021",nocase; classtype:attempted-recon; sid:200005536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/xz2130raxcw",nocase; classtype:attempted-recon; sid:200005537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf",nocase; classtype:attempted-recon; sid:200005538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf/",nocase; classtype:attempted-recon; sid:200005539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/ebuse/servic",nocase; classtype:attempted-recon; sid:200005540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/webaccountupdate/stockholmsuniversitet/",nocase; classtype:attempted-recon; sid:200005541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%20mbypfu8te0j3odtdaeiflu=&amp\;docid=1_1bdc33023238341e8b1471eb8a883076b&amp\;wdformid={24125711-8ad2-4ca2-bfd8-5b64dcc4e62d}&amp\;action=formsubmit&amp\;cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200005542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200005543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=ugnx8vv0hnbsrv%2fvcxzk70fvtpbgfohzofkdwg0fkks%3d&docid=1_14fdb459dd74a4d3aac22552ba4d394a6&wdformid=%7b4b57ec2d%2d6b56%2d419c%2da4e2%2d67f9f9a0264e%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%20mbypfu8te0j3odtdaeiflu=&amp\;docid=1_1bdc33023238341e8b1471eb8a883076b&amp\;wdformid={24125711-8ad2-4ca2-bfd8-5b64dcc4e62d}&amp\;action=formsubmit&amp\;cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200005545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200005547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=ugnx8vv0hnbsrv%2fvcxzk70fvtpbgfohzofkdwg0fkks%3d&docid=1_14fdb459dd74a4d3aac22552ba4d394a6&wdformid=%7b4b57ec2d%2d6b56%2d419c%2da4e2%2d67f9f9a0264e%7d&action=formsubmit&cid=4d93e72d-f0e5-4309-8366-df9357c3dc31",nocase; classtype:attempted-recon; sid:200005548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ifringesyllenesliopa.com",nocase; http_uri; content:"/notificaciones_popular/home_bpd/home.html/",nocase; classtype:attempted-recon; sid:200005549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igsasso-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pginet_groupe-igs_fr/_layouts/15/wopiframe.aspx?guestaccesstoken=o1ljzjnq70g8yg6w%2fce3ec9zu3%2bg6ck6ibkmhwt3wl0%3d&amp\;docid=1_1c2a91e87cc7a4ffb85611d8ebf31f653&amp\;wdformid=%7bcdf56303%2d9250%2d4cf1%2d8370%2db3f9a84cd714%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"im-creator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200005551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imcreator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200005552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/7a98388ed283f814fce649b21c516ea6",nocase; classtype:attempted-recon; sid:200005553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/7a98388ed283f814fce649b21c516ea6/",nocase; classtype:attempted-recon; sid:200005554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/7a98388ed283f814fce649b21c516ea6/security-questions.html",nocase; classtype:attempted-recon; sid:200005555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/882d42b59d9bcbe054e0be476b416136",nocase; classtype:attempted-recon; sid:200005556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/882d42b59d9bcbe054e0be476b416136/",nocase; classtype:attempted-recon; sid:200005557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/882d42b59d9bcbe054e0be476b416136/security-questions.html",nocase; classtype:attempted-recon; sid:200005558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/8f035033866a4643e0dffa60944c18c0",nocase; classtype:attempted-recon; sid:200005559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/8f035033866a4643e0dffa60944c18c0/security-questions.html",nocase; classtype:attempted-recon; sid:200005560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/ae48fbeca225b435d2649b9162c0a2e1",nocase; classtype:attempted-recon; sid:200005561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/ae48fbeca225b435d2649b9162c0a2e1/security-questions.html",nocase; classtype:attempted-recon; sid:200005562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/ebbefadc8b7c5810c7c65322d81e0241",nocase; classtype:attempted-recon; sid:200005563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/ebbefadc8b7c5810c7c65322d81e0241/",nocase; classtype:attempted-recon; sid:200005564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impressionsad.com.np",nocase; http_uri; content:"/bmo/ebbefadc8b7c5810c7c65322d81e0241/security-questions.html",nocase; classtype:attempted-recon; sid:200005565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"improvproject.com",nocase; http_uri; content:"/appmanager/renouvellement-automatique-obligatoire/ovh/managerweb-ovhdepartmenttechniqueovh/web.index.html5400configuration_hosting_database/web-ovh/vh/?user-agent=mozilla/5.0+(windows+nt+10.0\;+win64\;+x64)+applewebkit/537.36+(khtml,+like+gecko)+chrome/86.0.4240.75+safari/537.36",nocase; classtype:attempted-recon; sid:200005566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/emailupdatee/owaweb",nocase; classtype:attempted-recon; sid:200005567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade",nocase; classtype:attempted-recon; sid:200005568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/webmaiil/accounttportal",nocase; classtype:attempted-recon; sid:200005569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indeedcontract.com",nocase; http_uri; content:"/login",nocase; classtype:attempted-recon; sid:200005570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infocz2024.temp.swtest.ru",nocase; http_uri; content:"/myorderpost/",nocase; classtype:attempted-recon; sid:200005571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infocz2024.temp.swtest.ru",nocase; http_uri; content:"/myorderpost/a301fcd6ae4df201b8372aed34b0cbef/index.php?id=v6w3nvxqk2j",nocase; classtype:attempted-recon; sid:200005572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insurance2019.moneynet.com.tw",nocase; http_uri; content:"/wp-admin/maint/?hash=a2fyaw5hywxtzwlkyxjpymvpcm9aag90bwfpbc5jb20=",nocase; classtype:attempted-recon; sid:200005573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invoice-summary.upswimsuit.com",nocase; http_uri; content:"/?client-request-id=bg9naw4ucghw",nocase; classtype:attempted-recon; sid:200005574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/7rdd",nocase; classtype:attempted-recon; sid:200005575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/dxmn",nocase; classtype:attempted-recon; sid:200005576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/qbe9",nocase; classtype:attempted-recon; sid:200005577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2g5uj6",nocase; classtype:attempted-recon; sid:200005578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2grfj6",nocase; classtype:attempted-recon; sid:200005579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.ru",nocase; http_uri; content:"/2pmvx5",nocase; classtype:attempted-recon; sid:200005580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iqcleaner.com",nocase; http_uri; content:"/click.php?key=0nh33i3c4nz29x1i3fs2&amp\;click_id=push_20211002095432_e407ca4f_a4be_4b17_955e_1a0fdc395e72&amp\;bid=0.0741&amp\;source=305598&amp\;supply_id=331&amp\;country=gb&amp\;campaign_id=389853&amp\;devicename=generic+android+4.0&amp\;city=stockton-on-tees&amp\;language=&amp\;site_id=331-305598&amp\;creativity_id=1670028&amp\;userage=4#",nocase; classtype:attempted-recon; sid:200005581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/amazosuporrt",nocase; classtype:attempted-recon; sid:200005582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/gtzqpnd8jp",nocase; classtype:attempted-recon; sid:200005583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/s960y1",nocase; classtype:attempted-recon; sid:200005584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ivegotoptions.com",nocase; http_uri; content:"/reflexivea.php",nocase; classtype:attempted-recon; sid:200005585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.gs",nocase; http_uri; content:"/cpjh",nocase; classtype:attempted-recon; sid:200005586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/2zztiem?/pages-help.htm",nocase; classtype:attempted-recon; sid:200005587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/35an7jt",nocase; classtype:attempted-recon; sid:200005588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3arx6oo",nocase; classtype:attempted-recon; sid:200005589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3gydg8x?/supporrecovery",nocase; classtype:attempted-recon; sid:200005590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3jf7jnh",nocase; classtype:attempted-recon; sid:200005591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3kkkf0n",nocase; classtype:attempted-recon; sid:200005592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3vlssio?/fpconfirmvtns",nocase; classtype:attempted-recon; sid:200005593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtbtigers.com",nocase; http_uri; content:"/65g2g",nocase; classtype:attempted-recon; sid:200005594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvz7.com",nocase; http_uri; content:"/c/2057113/367593",nocase; classtype:attempted-recon; sid:200005595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k12inc-my.sharepoint.com",nocase; http_uri; content:"/personal/jdonahue_k12_com/_layouts/15/wopiframe.aspx?guestaccesstoken=jxndynkzmynao0nofzmhz4t%2fk%2br%2fg7qir2agrjo42ha%3d&docid=1_12252b23331654ef4bf8ef978a8eb83ee&wdformid=%7b2711d93c%2d7591%2d4baa%2db377%2dcf40ba8c7343%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/p59j",nocase; classtype:attempted-recon; sid:200005597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/c07czi",nocase; classtype:attempted-recon; sid:200005598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefcadastrodesatualizado",nocase; classtype:attempted-recon; sid:200005599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefhomebanking",nocase; classtype:attempted-recon; sid:200005600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/cefvaiidacaodigitai",nocase; classtype:attempted-recon; sid:200005601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/l3leph",nocase; classtype:attempted-recon; sid:200005602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/v6aqx1",nocase; classtype:attempted-recon; sid:200005603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=http://findyourdns.com/qo9pf6d",nocase; classtype:attempted-recon; sid:200005604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https%3a%2f%2fabre.ai%2fduey?trackingid=apf7lg8x&signature=newsletter",nocase; classtype:attempted-recon; sid:200005605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https%3a%2f%2flmy.de%2fs4zbc?trackingid=kujeulsr&signature=newsletter",nocase; classtype:attempted-recon; sid:200005606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dbh1?userid=i4uhe91l",nocase; classtype:attempted-recon; sid:200005607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dowu?userid=ajf0mm8d",nocase; classtype:attempted-recon; sid:200005608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dtzj?userid=dkg9y3bn",nocase; classtype:attempted-recon; sid:200005609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dtzj?userid=eh07okgu",nocase; classtype:attempted-recon; sid:200005610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dtzj?userid=k44xuuwo",nocase; classtype:attempted-recon; sid:200005611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dtzj?userid=nguehnko",nocase; classtype:attempted-recon; sid:200005612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/duj7?userid=iwjffa3m",nocase; classtype:attempted-recon; sid:200005613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dvuw?userid=u5zl5eph",nocase; classtype:attempted-recon; sid:200005614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://abre.ai/dvuw?userid=vvthexcl",nocase; classtype:attempted-recon; sid:200005615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://findyourdns.com/h0v6e0b",nocase; classtype:attempted-recon; sid:200005616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/avur?userid=y8bi5gwe",nocase; classtype:attempted-recon; sid:200005617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/t8yq?userid=qdpsfluc",nocase; classtype:attempted-recon; sid:200005618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=doteiphj",nocase; classtype:attempted-recon; sid:200005619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=iykpku7b",nocase; classtype:attempted-recon; sid:200005620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=sbhiiqzp",nocase; classtype:attempted-recon; sid:200005621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://qr.paps.jp/v9oq?userid=znq25vxv",nocase; classtype:attempted-recon; sid:200005622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a4doq",nocase; classtype:attempted-recon; sid:200005623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a6rct",nocase; classtype:attempted-recon; sid:200005624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/h24ve?userid=e8pfoasz",nocase; classtype:attempted-recon; sid:200005625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://verify.cqptxcl.com/ww2vjin",nocase; classtype:attempted-recon; sid:200005626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lifeiswhatyoumakeofit.com",nocase; http_uri; content:"/match_login/match.com/match/login1876.html",nocase; classtype:attempted-recon; sid:200005627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/4pynu/vervanging",nocase; classtype:attempted-recon; sid:200005628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/61uks",nocase; classtype:attempted-recon; sid:200005629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/7au74?userid=rlmj8zoe",nocase; classtype:attempted-recon; sid:200005630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/fqg9x",nocase; classtype:attempted-recon; sid:200005631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/gukxe",nocase; classtype:attempted-recon; sid:200005632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/jif9o",nocase; classtype:attempted-recon; sid:200005633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/uh2xv",nocase; classtype:attempted-recon; sid:200005634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.zixcentral.com",nocase; http_uri; content:"/u/28c878da/ycspgffb6hgbim_i5f7krg?u=https%3a%2f%2fuser23546576879809ip.dt.r.appspot.com%2f%23cfishkin%40careevolve.com",nocase; classtype:attempted-recon; sid:200005635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/02x7r9",nocase; classtype:attempted-recon; sid:200005636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/2ow6k5",nocase; classtype:attempted-recon; sid:200005637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/58129/",nocase; classtype:attempted-recon; sid:200005638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/6lw0vp",nocase; classtype:attempted-recon; sid:200005639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/80lqyv",nocase; classtype:attempted-recon; sid:200005640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/88vj3",nocase; classtype:attempted-recon; sid:200005641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/9645x",nocase; classtype:attempted-recon; sid:200005642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/j4vw4",nocase; classtype:attempted-recon; sid:200005643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkr.bio",nocase; http_uri; content:"/p1jx4",nocase; classtype:attempted-recon; sid:200005644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/adeptcse2",nocase; classtype:attempted-recon; sid:200005645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/att_update",nocase; classtype:attempted-recon; sid:200005646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attdesk",nocase; classtype:attempted-recon; sid:200005647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attmail354",nocase; classtype:attempted-recon; sid:200005648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attonlineverify",nocase; classtype:attempted-recon; sid:200005649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attonverification",nocase; classtype:attempted-recon; sid:200005650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/atttverifyweb",nocase; classtype:attempted-recon; sid:200005651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attyah00service",nocase; classtype:attempted-recon; sid:200005652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attyah00service/",nocase; classtype:attempted-recon; sid:200005653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/betesc",nocase; classtype:attempted-recon; sid:200005654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/boxm",nocase; classtype:attempted-recon; sid:200005655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btechles",nocase; classtype:attempted-recon; sid:200005656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btupdatesupport",nocase; classtype:attempted-recon; sid:200005657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/capricetienda",nocase; classtype:attempted-recon; sid:200005658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eftremittance",nocase; classtype:attempted-recon; sid:200005659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/freeaccountlinkupdatt",nocase; classtype:attempted-recon; sid:200005660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hshdkwkdkd",nocase; classtype:attempted-recon; sid:200005661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/mailadminservicelogin",nocase; classtype:attempted-recon; sid:200005662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/officialpubgonmobile",nocase; classtype:attempted-recon; sid:200005663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/onlineatt",nocase; classtype:attempted-recon; sid:200005664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paypai.account",nocase; classtype:attempted-recon; sid:200005665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/perfectaol",nocase; classtype:attempted-recon; sid:200005666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/promotitans19",nocase; classtype:attempted-recon; sid:200005667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/promotitans19/",nocase; classtype:attempted-recon; sid:200005668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pubgxmetrodus",nocase; classtype:attempted-recon; sid:200005669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/sharedpdfonline",nocase; classtype:attempted-recon; sid:200005670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/skinnews18",nocase; classtype:attempted-recon; sid:200005671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/solutionsofaccount",nocase; classtype:attempted-recon; sid:200005672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/xfinitystatusupdate",nocase; classtype:attempted-recon; sid:200005673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/yahoomailservicess",nocase; classtype:attempted-recon; sid:200005674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liongear.com",nocase; http_uri; content:"/sos/docusign%20global%20standard%20for%20e%20signature/docusign%20global%20standard%20for%20e%20signature/profit-maximization/profit-maximization-2018",nocase; classtype:attempted-recon; sid:200005675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liongear.com",nocase; http_uri; content:"/sos/docusign%20global%20standard%20for%20e%20signature/docusign%20global%20standard%20for%20e%20signature/profit-maximization/profit-maximization-2018/",nocase; classtype:attempted-recon; sid:200005676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liongear.com",nocase; http_uri; content:"/sos/docusign%20global%20standard%20for%20e%20signature/docusign%20global%20standard%20for%20e%20signature/profit-maximization/profit-maximization-2018/aol/index.html",nocase; classtype:attempted-recon; sid:200005677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lippielust.com",nocase; http_uri; content:"/com/es/",nocase; classtype:attempted-recon; sid:200005678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livecentralmethodist-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/dhenton_centralmethodist_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=vm7oywkd6txbnegb6f4rse1sjrazwwksz07yel95pqm%3d&docid=1_1f7d08135a62e47a19487c47ada16ad67&wdformid=%7b17961023-54f0-4010-b064-4e027c713cc9%7d&action=formsubmit&cid=332d7ef6-7fa6-4be8-b941-a92f0589601f",nocase; classtype:attempted-recon; sid:200005679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=bcxwl3a7ttskgw2polh3cucg2dfe77pbj2gkmixkizs%3d&docid=1_1b87bddf46e1144efadb39c587acdadae&wdformid=%7b5b4e96cf%2d1bcd%2d468f%2da845%2d09b4d8027bc2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=bcxwl3a7ttskgw2polh3cucg2dfe77pbj2gkmixkizs=&amp\;docid=1_1b87bddf46e1144efadb39c587acdadae&amp\;wdformid={5b4e96cf-1bcd-468f-a845-09b4d8027bc2}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=fnyckzjagh3z%2bl1cadcdqxot6rfyhmeonulx7ksc7pq%3d&docid=1_15129478f60da40db8395b5675832ef56&wdformid=%7b000c8ab1%2dcbc8%2d44e3%2dac19%2d0015f01b771e%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200005684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=za7yvssjtzxen%2fcnb0hswkqniem%2fcumgrmfvnt4f8cy%3d&docid=1_128a2a62563b647c9b1b6806600fd8a09&wdformid=%7b20510126%2dfb1d%2d4e63%2d9e6a%2df86488e1d5c6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dbzedyn",nocase; classtype:attempted-recon; sid:200005686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dc_qgjgt",nocase; classtype:attempted-recon; sid:200005687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ddbtt4jr",nocase; classtype:attempted-recon; sid:200005688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dfqcc_p3",nocase; classtype:attempted-recon; sid:200005689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dj_3k8su",nocase; classtype:attempted-recon; sid:200005690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dp5b5skn",nocase; classtype:attempted-recon; sid:200005691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dycnfuz",nocase; classtype:attempted-recon; sid:200005692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e36gkwdp",nocase; classtype:attempted-recon; sid:200005693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e3xwk_zv",nocase; classtype:attempted-recon; sid:200005694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e4bf6sus",nocase; classtype:attempted-recon; sid:200005695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e4thv3et",nocase; classtype:attempted-recon; sid:200005696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e82btthq",nocase; classtype:attempted-recon; sid:200005697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ea5pq63m",nocase; classtype:attempted-recon; sid:200005698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ea7zympf",nocase; classtype:attempted-recon; sid:200005699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eadanmmk",nocase; classtype:attempted-recon; sid:200005700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eewcuqvf",nocase; classtype:attempted-recon; sid:200005701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ehfif4yx",nocase; classtype:attempted-recon; sid:200005702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ehmh9dua",nocase; classtype:attempted-recon; sid:200005703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ehvpayzf",nocase; classtype:attempted-recon; sid:200005704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ekmjqn_n",nocase; classtype:attempted-recon; sid:200005705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ep6dv_fz",nocase; classtype:attempted-recon; sid:200005706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/eqnk2_dk",nocase; classtype:attempted-recon; sid:200005707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ergg_5vi",nocase; classtype:attempted-recon; sid:200005708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ernn4n6w",nocase; classtype:attempted-recon; sid:200005709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/evpzpthw",nocase; classtype:attempted-recon; sid:200005710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/g4crt_h6",nocase; classtype:attempted-recon; sid:200005711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/g5vaz4ue",nocase; classtype:attempted-recon; sid:200005712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/g6uj-x4y",nocase; classtype:attempted-recon; sid:200005713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/g738arxe",nocase; classtype:attempted-recon; sid:200005714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gchgbunh",nocase; classtype:attempted-recon; sid:200005715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gfkcfnvf",nocase; classtype:attempted-recon; sid:200005716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gkcfvhqk",nocase; classtype:attempted-recon; sid:200005717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gqmvpage",nocase; classtype:attempted-recon; sid:200005718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/grc_k5rb",nocase; classtype:attempted-recon; sid:200005719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gtk_5a-v",nocase; classtype:attempted-recon; sid:200005720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gtnpr-ej",nocase; classtype:attempted-recon; sid:200005721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gwaajkqi",nocase; classtype:attempted-recon; sid:200005722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gysv2j_s",nocase; classtype:attempted-recon; sid:200005723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkj.in",nocase; http_uri; content:"/p/orangeindex",nocase; classtype:attempted-recon; sid:200005724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/6z7w",nocase; classtype:attempted-recon; sid:200005725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/78q2",nocase; classtype:attempted-recon; sid:200005726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.xfinity.meculinkvolt.com",nocase; http_uri; content:"/home/?6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d-6c6f67696e2e7866696e6974792e6d6563756c696e6b766f6c742e636f6d",nocase; classtype:attempted-recon; sid:200005727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lp.vp4.me",nocase; http_uri; content:"/ppt9",nocase; classtype:attempted-recon; sid:200005728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200005729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt1ucddud2vssjewzw",nocase; classtype:attempted-recon; sid:200005730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt1vvm5wuy1ssjewzw",nocase; classtype:attempted-recon; sid:200005731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200005732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt1vvm5wuy1ssjewzw",nocase; classtype:attempted-recon; sid:200005733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/bobfrank2070",nocase; classtype:attempted-recon; sid:200005734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/govt.official.compensate.help.grant",nocase; classtype:attempted-recon; sid:200005735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magidcarpet.com",nocase; http_uri; content:"/express/dhlexpil/dhl/info.php",nocase; classtype:attempted-recon; sid:200005736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magyarpoosta.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200005737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.hfcfit.com",nocase; http_uri; content:"/forms/forms/form1.html",nocase; classtype:attempted-recon; sid:200005738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pplastmart.com",nocase; http_uri; content:"/att/citi",nocase; classtype:attempted-recon; sid:200005739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pplastmart.com",nocase; http_uri; content:"/att/citi/",nocase; classtype:attempted-recon; sid:200005740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.secure6t-verifi.duckdns.org",nocase; http_uri; content:"/secure/wellsfargo/session/signin.php?appidkey=uitknzdkzsvmpe9c3a6ovbxi7j&country=us&error=",nocase; classtype:attempted-recon; sid:200005741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/179.32.144.1585349/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200005742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/179.32.144.1585349/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200005743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/181.143.31.2028037/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200005744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/181.143.31.2028037/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200005745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200005746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200005747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.27.90.2077221/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200005748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200005749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200005750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200005751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200005752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.95.152.1287758/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200005753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/201.233.42.1501206/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200005754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mandrillapp.com",nocase; http_uri; content:"/track/open.php?u=31096627&amp\;id=6afd950eb98a41aba6b4fb92bd5edb02&quot\; height=&quot\;1&quot\; width=&quot\;1&quot\;&gt\;",nocase; classtype:attempted-recon; sid:200005755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mastercard.co.jp",nocase; http_uri; content:"/ja-jp.html",nocase; classtype:attempted-recon; sid:200005756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matadormeteo.com",nocase; http_uri; content:"/survey/27415/source=39-/subid=39/nrp=7f6cd6e4992346a1a638bd273c176723",nocase; classtype:attempted-recon; sid:200005757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matadormeteo.com",nocase; http_uri; content:"/survey/33222/source%3d49-/subid%3d49/nrp%3da851f443313c4318b73274992f7eb0b2?s3=125_37947_29_307706_md&s1=37947&s2=1_34501_0",nocase; classtype:attempted-recon; sid:200005758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matadormeteo.com",nocase; http_uri; content:"/survey/33222/source=49-/subid=49/nrp=a851f443313c4318b73274992f7eb0b2?s3=125_37947_29_307706_md&s1=37947&s2=1_34501_0",nocase; classtype:attempted-recon; sid:200005759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.do",nocase; http_uri; content:"/gsxwbop3?userid=fkgowcl6",nocase; classtype:attempted-recon; sid:200005760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/1gne6",nocase; classtype:attempted-recon; sid:200005761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/6w9qj",nocase; classtype:attempted-recon; sid:200005762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/77srn",nocase; classtype:attempted-recon; sid:200005763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/g492k",nocase; classtype:attempted-recon; sid:200005764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/g50gq",nocase; classtype:attempted-recon; sid:200005765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/hfldu",nocase; classtype:attempted-recon; sid:200005766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/ibyyn",nocase; classtype:attempted-recon; sid:200005767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/ij3t9",nocase; classtype:attempted-recon; sid:200005768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/jlrbo",nocase; classtype:attempted-recon; sid:200005769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/qpwha",nocase; classtype:attempted-recon; sid:200005770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/reu8w",nocase; classtype:attempted-recon; sid:200005771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/sb6ww",nocase; classtype:attempted-recon; sid:200005772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.kr",nocase; http_uri; content:"/yehg0",nocase; classtype:attempted-recon; sid:200005773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?authuser=0&amp\;dest=https%3a%2f%2flinktr.ee%2fpaypai.serviceid?idtrack=kzsykctt",nocase; classtype:attempted-recon; sid:200005774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?dest=http://hunter.capitalfinaleu.com/?ahvudgvyqg1pzs51dg9yb250by5jyq==/username",nocase; classtype:attempted-recon; sid:200005775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication",nocase; classtype:attempted-recon; sid:200005776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.homedepot.com",nocase; http_uri; content:"/p/cp/46595ecebf250010/c?mi_u=54632464&amp\;url=https%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj%26q%3d%26esrc%3ds%26source%3dweb%26cd%3d%26cad%3drja%26uact%3d8%26ved%3d2ahukewiq5z7q2ehsahvt5uakhem0c-cqfjaaegqibrac%26url%3dhttp%253a%252f%252fwww.agtroma.it%252fesperienze.htm%26usg%3daovvaw0qjsiebpcbznvj3y5d6wvu",nocase; classtype:attempted-recon; sid:200005777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.jetblue.com",nocase; http_uri; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php",nocase; classtype:attempted-recon; sid:200005778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanno342.blogspot.com",nocase; http_uri; content:"/2020/11/fiyatlar.html",nocase; classtype:attempted-recon; sid:200005779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mmini.me",nocase; http_uri; content:"/hsfm-u",nocase; classtype:attempted-recon; sid:200005780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/reset_account.php",nocase; classtype:attempted-recon; sid:200005781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/verify_account.php",nocase; classtype:attempted-recon; sid:200005782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/verify_account.php?appidkey=",nocase; classtype:attempted-recon; sid:200005783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/verify_account.php?error=please%20enter%20valid%20atm%20pin",nocase; classtype:attempted-recon; sid:200005784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/verify_account.php?error=please%20enter%20valid%20atm%20pin&amp\;appidkey=&amp\;country=us",nocase; classtype:attempted-recon; sid:200005785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modelpharmacyrx.com",nocase; http_uri; content:"/neww/wellsfargo/session/verify_account.php?error=pleaseentervalidatmpin",nocase; classtype:attempted-recon; sid:200005786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monghaber.com",nocase; http_uri; content:"/.well-known/dhlwe.html",nocase; classtype:attempted-recon; sid:200005787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monovative-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/user_monovative_onmicrosoft_com/emczkjnkzgxdtejtstz67qqblknarn4da620kjaje91ewq?e=5:weseg8&amp\;at=9",nocase; classtype:attempted-recon; sid:200005788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monstercarp.rn86.ru",nocase; http_uri; content:"/dvtygtgvrv.html?ggcdraewqaszxfdxcgchjbjnhbgvfcdrxtcyvbuninhbygtfcrx",nocase; classtype:attempted-recon; sid:200005789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mumbaiescortsx.in",nocase; http_uri; content:"/google016s08f45rt40/",nocase; classtype:attempted-recon; sid:200005790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-btc-profit.com",nocase; http_uri; content:"/en?campaign_id=7pjhyyt6&external_click_id=e9871476-03e5-435f-b45b-ca7fa122ba2e&affname1=jamesonwells&net3=1111&reserv4=&reserv5=&aff_sub1=4ed792txirn3yd44&aff_sub2=&aff_sub3=&fbp=&ksget=1&tc=sms&analytics_session_id=d42ac036-668b-4f38-a21b-14651b15dc88&token=61656e1592a5414cfa24d388",nocase; classtype:attempted-recon; sid:200005791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/60deff002ca34f5aa4985ab3",nocase; classtype:attempted-recon; sid:200005792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/6112452ca3f6e60d511bad0d",nocase; classtype:attempted-recon; sid:200005793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/615dc3d1144583702783c2c5",nocase; classtype:attempted-recon; sid:200005794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/6168204a612c0404e6397f6b",nocase; classtype:attempted-recon; sid:200005795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/617141d86b145458aa0ced80",nocase; classtype:attempted-recon; sid:200005796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/618a5d958c8fa556a17a80f9",nocase; classtype:attempted-recon; sid:200005797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/mross3200/untitled-form",nocase; classtype:attempted-recon; sid:200005798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200005799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200005800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysait-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ebenezer_ajayi_edu_sait_ca/_layouts/15/wopiframe.aspx?guestaccesstoken=y%2bhr1dv9mxgpih7r4y%2f%2fjkhvv1nxdh3imaz%2bmjeumni%3d&docid=1_1ff1eb35301564d1698455e7de780fe7f&wdformid=%7b2b1e75ff%2d4748%2d448a%2db5f7%2d7d4a5138e7f7%7d&action=formsubmit&cid=b8bab67a-6675-4883-8c86-32942813ffb3",nocase; classtype:attempted-recon; sid:200005801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"na.eventscloud.com",nocase; http_uri; content:"/emarketing/go.php?i=currentblast&amp\;e=subscriberemailec&amp\;l=http://vrgluyyth5.2764.evanet.com.tr/vrgluyyth5/ahr0chm6ly9oywxpc2r1cnvtlmnvbs9pbmrlec92umdmvvl5dgg1lza5mje2nzq4my91c2vyl3vzzxjazxhhbxbszs5jb20=",nocase; classtype:attempted-recon; sid:200005802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg140587-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/david_siteproperty_com/eq8kw97vmw9jkutctnkcbxkbmdwlprnakta1bywrks5-hw?e=vmna6v",nocase; classtype:attempted-recon; sid:200005803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7",nocase; classtype:attempted-recon; sid:200005804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg791425-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/gscaglione_shulmanventures_com/esbu2b9nnzjagf5sh57gkkcbf8xzlqtnsdbogrc9uo_6-w?e=6kdxdd",nocase; classtype:attempted-recon; sid:200005805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft2223515-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/leon_leongavartin_com/_layouts/15/wopiframe.aspx?guestaccesstoken=rpanwaz3gooz0d20j9wu7zzskog8p5egpbt4oc5j5bq%3d&docid=1_137b486a2059c4fc7b670d2ddb8f27254&wdformid=%7b07fe213f%2d4079%2d45b9%2db73f%2dfa9809248dd7%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft2223515-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/leon_leongavartin_com/_layouts/15/wopiframe.aspx?guestaccesstoken=xamh1yie5ztbehymkwldcb6bkcf1kqp13dwjvauswg4%3d&docid=1_10f85e31d21194b00bc5c96bd48a6a4fc&wdformid=%7b702d2762%2df654%2d423b%2dba6b%2d850079f6ed46%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nexoinmobiliario.pe",nocase; http_uri; content:"/bancos/interbank",nocase; classtype:attempted-recon; sid:200005808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihmt.com",nocase; http_uri; content:"/examination/admitpanel/filemanager/5365678587",nocase; classtype:attempted-recon; sid:200005809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"norwayposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200005810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"objectstorage.us-phoenix-1.oraclecloud.com",nocase; http_uri; content:"/n/axjt4zimmriy/b/cherishppps-20210930-1214/o/spaceblack.html",nocase; classtype:attempted-recon; sid:200005811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=b730f58852aff932!139&amp\;ithint=onenote%2c&amp\;wdo=2&amp\;authkey=!aul7udqhfptgafm",nocase; classtype:attempted-recon; sid:200005812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/dssmibyk/789c19c6-58f7-4a39-8cf3-62e4f13c605a",nocase; classtype:attempted-recon; sid:200005813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/lvswydoz/f4123832-7b09-4ac6-bbfc-9fde28e728c4",nocase; classtype:attempted-recon; sid:200005814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e",nocase; classtype:attempted-recon; sid:200005815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinecasinospark.com",nocase; http_uri; content:"/ions/index.php?email=redacted@abuse.ionos.com",nocase; classtype:attempted-recon; sid:200005816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opsxpert.com",nocase; http_uri; content:"/all/ppp/?login=sudha@bentonbiz.com",nocase; classtype:attempted-recon; sid:200005817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200005818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oraclemart.com",nocase; http_uri; content:"/ondedrive/onedrive/rolex/index.php",nocase; classtype:attempted-recon; sid:200005819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ow.ly",nocase; http_uri; content:"/lcqx30cdfcg",nocase; classtype:attempted-recon; sid:200005820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200005821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200005822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200005823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200005824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''",nocase; classtype:attempted-recon; sid:200005825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200005836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200005837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oyknrmzazildlsaxutqiatopgs-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200005838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"padlet-uploads.storage.googleapis.com",nocase; http_uri; content:"/610964646/d0a82b340ac6b4eb2fed334399fe2e84/palad.html",nocase; classtype:attempted-recon; sid:200005839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paozeia.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parnamg.info",nocase; http_uri; content:"/index.php",nocase; classtype:attempted-recon; sid:200005841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/25qk2",nocase; classtype:attempted-recon; sid:200005842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26c30",nocase; classtype:attempted-recon; sid:200005843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26dcc",nocase; classtype:attempted-recon; sid:200005844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26e8w",nocase; classtype:attempted-recon; sid:200005845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/278zi",nocase; classtype:attempted-recon; sid:200005846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/27tk1",nocase; classtype:attempted-recon; sid:200005847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2884c",nocase; classtype:attempted-recon; sid:200005848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/28eek",nocase; classtype:attempted-recon; sid:200005849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2980b",nocase; classtype:attempted-recon; sid:200005850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29igl",nocase; classtype:attempted-recon; sid:200005851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29jzn",nocase; classtype:attempted-recon; sid:200005852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29n5y",nocase; classtype:attempted-recon; sid:200005853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29vnj",nocase; classtype:attempted-recon; sid:200005854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2a9kr",nocase; classtype:attempted-recon; sid:200005855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9m",nocase; classtype:attempted-recon; sid:200005856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9x",nocase; classtype:attempted-recon; sid:200005857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2amyg",nocase; classtype:attempted-recon; sid:200005858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2btlc",nocase; classtype:attempted-recon; sid:200005859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c1g8",nocase; classtype:attempted-recon; sid:200005860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c396",nocase; classtype:attempted-recon; sid:200005861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paws.org.au",nocase; http_uri; content:"/store/admin/view/javascript/fckeditor/editor/plugins/valid.free.fr/adsl",nocase; classtype:attempted-recon; sid:200005862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paws.org.au",nocase; http_uri; content:"/store/admin/view/javascript/fckeditor/editor/plugins/valid.free.fr/adsl/",nocase; classtype:attempted-recon; sid:200005863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-inc-userupdatenuber7925570844.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200005864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbox.photobox.co.uk",nocase; http_uri; content:"/dynclick/photobox-uk/?eml-publisher=photobox-uk&amp\;eml-name=phx_t_uk_new_crn_e2_bau_all&amp\;uid=67912768&amp\;eurl=http://photobox-mkt-prod1-t.campaign.adobe.com/r/?id=h4e5ec0b9,69a17086,5eb6e68f&amp\;utm_source=photobox&amp\;utm_medium=email&amp\;utm_campaign=t_all_w26_20200623_uk_crn_tips-and-trading-plan_2_bau_ac1982206_web_1772187782&amp\;_c1v=crm&amp\;_c2v=trigger&amp\;_c3v=creation&amp\;_c4id=1982206&amp\;_c5id=1772187782&amp\;_c6id=all&amp\;_c7id=acc&amp\;_cdt=2020-06-23&amp\;_ceh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;_cleh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;p1=ak-x.shop/?e=zg91z2xhc0btewnvbxbhbnltywdhemluzs5jb20=%23/my/creations",nocase; classtype:attempted-recon; sid:200005865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pilgrimapp.com",nocase; http_uri; content:"/wp-mails/",nocase; classtype:attempted-recon; sid:200005866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/css/login.htm?email=&amp\;email&amp\;",nocase; classtype:attempted-recon; sid:200005867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html",nocase; classtype:attempted-recon; sid:200005868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;flag=isle&amp\;tracelog=edmfooter&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notification20160310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notificationtips2016310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_privacy&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_term&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?url_type=header_homepage&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200005874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plaqexit.com",nocase; http_uri; content:"/?a=1705&amp\;oc=14269&amp\;c=40227&amp\;p=r&amp\;m=3&amp\;s1=32_11018_849&amp\;s2=19_26533_8907_4&amp\;s3=502784594&amp\;s5=15ctxxp&amp\;ckmguid=b2f081b7-847c-48a9-a11d-ceebad0d02d4",nocase; classtype:attempted-recon; sid:200005875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/pasi_puumalainen_plytec_fi/eviubi-o5_rgorvtg1ptinyb5th9mqv-2ev_l8ujkorojg?e=5%3a8603ib&at=9",nocase; classtype:attempted-recon; sid:200005876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/personal/pasi_puumalainen_plytec_fi/_layouts/15/wopiframe.aspx?sourcedoc={8f0414f2-e7a8-46f4-a2bb-d38353ed20d6}&amp\;action=default&amp\;originalpath=ahr0chm6ly9wbhl0zwnmas1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9wyxnpx3b1dw1hbgfpbmvux3bsexrly19mas9fdklvqkktbzvfukdvcnzuzzfqdelowui1vgg5bxf2ltjlvl9mohvka09sb2pnp3j0aw1lpxvysjgtvnb2mtbn",nocase; classtype:attempted-recon; sid:200005877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; http_uri; content:"/archives/%3c17bb1b72.aa4aabambdsaachbnjiaaagn5iaaaaaajbganduyabbhkabgnaaw%40mailjet.com%3e%7cxntjjt7d%2bpgxnycpm8zjag%3d%3d",nocase; classtype:attempted-recon; sid:200005878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/29149732#page",nocase; classtype:attempted-recon; sid:200005879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pplastmart.com",nocase; http_uri; content:"/att/citi",nocase; classtype:attempted-recon; sid:200005880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppt.cc",nocase; http_uri; content:"/fia8mx",nocase; classtype:attempted-recon; sid:200005881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppt.cc",nocase; http_uri; content:"/fva4wx",nocase; classtype:attempted-recon; sid:200005882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppt.cc",nocase; http_uri; content:"/fvakzx",nocase; classtype:attempted-recon; sid:200005883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppt.cc",nocase; http_uri; content:"/fvllvx",nocase; classtype:attempted-recon; sid:200005884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_20",nocase; classtype:attempted-recon; sid:200005885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=diaa0",nocase; classtype:attempted-recon; sid:200005886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=hiatb",nocase; classtype:attempted-recon; sid:200005887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=x5wo8",nocase; classtype:attempted-recon; sid:200005888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect2.fireeye.com",nocase; http_uri; content:"/url?k=1d4614ec17334d4a.1d465a2d-45b66b5f372e82c4&amp\;u=http://www.standrew.co.kr/bluead/editor/uploaded/img/caslog1/cas.auth.sc.edu/uofsc.html",nocase; classtype:attempted-recon; sid:200005889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pub43.bravenet.com",nocase; http_uri; content:"/emailfwd/show.php?usernum=3669541711&amp\;formid=3811",nocase; classtype:attempted-recon; sid:200005890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pub5.bravenet.com",nocase; http_uri; content:"/emailfwd/show.php?usernum=350311855&amp\;formid=3879",nocase; classtype:attempted-recon; sid:200005891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/eg8osty0",nocase; classtype:attempted-recon; sid:200005892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/eg8osty0/",nocase; classtype:attempted-recon; sid:200005893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/pfbgzhkd",nocase; classtype:attempted-recon; sid:200005894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/umjjyvmr",nocase; classtype:attempted-recon; sid:200005895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/vn79myoi",nocase; classtype:attempted-recon; sid:200005896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; http_uri; content:"/0/?i=i&amp\;0=info@google.com",nocase; classtype:attempted-recon; sid:200005897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200005898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200005899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200005900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200005901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''",nocase; classtype:attempted-recon; sid:200005902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200005913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200005914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qevwisdfztymporlndsckabdil-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200005915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qu28t0z4cq.sembolin0sgrachatcredit.com",nocase; http_uri; content:"/rd/c507beqag1244882wfxm52879flr7387rpqq181",nocase; classtype:attempted-recon; sid:200005916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200005917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%3e%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200005918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200005919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/a/takesurvey?tt=2fnfqos%2bhkc%3d",nocase; classtype:attempted-recon; sid:200005920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/a/takesurvey?tt=3huhnku51ks%3d",nocase; classtype:attempted-recon; sid:200005921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/a/takesurvey?tt=ttqo2grc8mo%3d",nocase; classtype:attempted-recon; sid:200005922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/a/takesurvey?tt=ua9txl20unu5rcngxsibha==&lcfpn=false",nocase; classtype:attempted-recon; sid:200005923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/t/aur4izp4ui",nocase; classtype:attempted-recon; sid:200005924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"questionpro.com",nocase; http_uri; content:"/t/auuiqzp8qy",nocase; classtype:attempted-recon; sid:200005925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quip.com",nocase; http_uri; content:"/qv7malu8n7cz/you-have-some-messages-pending",nocase; classtype:attempted-recon; sid:200005926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.smore.com",nocase; http_uri; content:"/c?u=https://yanamholidays.com/b00-b26n5-82m-c04b-o84v-13h-e66-t38e-c90?m5=eric.stockland@iextrading.com",nocase; classtype:attempted-recon; sid:200005927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r3g34.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/77ll23ween.html",nocase; classtype:attempted-recon; sid:200005928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05",nocase; classtype:attempted-recon; sid:200005929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05?m=1",nocase; classtype:attempted-recon; sid:200005930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020?m=1",nocase; classtype:attempted-recon; sid:200005931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reamaam.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/8k8kt",nocase; classtype:attempted-recon; sid:200005933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/ahcz51u",nocase; classtype:attempted-recon; sid:200005934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/w1lrupp",nocase; classtype:attempted-recon; sid:200005935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/wjqi04k",nocase; classtype:attempted-recon; sid:200005936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/z83ig2n?rb.routing.mode=proxy&amp\;rb.routing.signature=123 836",nocase; classtype:attempted-recon; sid:200005937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zikqv8f?email=eimaste@stinpriza.org&amp\;domain=stinpriza.orgwebapp*",nocase; classtype:attempted-recon; sid:200005938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zitln6v",nocase; classtype:attempted-recon; sid:200005939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redatofadesafe.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"release-held-messageshee.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/v01iebe3vicvgirviexv4sbdve1r03f.html",nocase; classtype:attempted-recon; sid:200005941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"renew.trusted-travelers-online.com",nocase; http_uri; content:"/renew-global-entry",nocase; classtype:attempted-recon; sid:200005942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/1xrr1y",nocase; classtype:attempted-recon; sid:200005943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/brkoqe",nocase; classtype:attempted-recon; sid:200005944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/dvk4gd",nocase; classtype:attempted-recon; sid:200005945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/gvjolp?co=muj3e",nocase; classtype:attempted-recon; sid:200005946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/xeknoz?confirmation",nocase; classtype:attempted-recon; sid:200005947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/xgmxr1",nocase; classtype:attempted-recon; sid:200005948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rewardscentral.com.au",nocase; http_uri; content:"/earn/to.aspx?uid=&amp\;aid=55b24dcc-1283-46e0-b2c1-55c43d08bbd3&amp\;email=0&amp\;reurl=https://infic.net/amc/cache/index.php",nocase; classtype:attempted-recon; sid:200005949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riderctposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200005950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/22135e276669c5c0853f5151faeab7a6/?user=&amp\;.verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/22135e276669c5c0853f5151faeab7a6?user=&amp\;.verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/5b39080e056b09dd0481718ea8f0a95e/?user=&amp\;_verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/5b39080e056b09dd0481718ea8f0a95e?user=&amp\;_verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/f9bd8d1b3e3fcbb8993b4dd9b1326b48/?user=&amp\;_verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riveroflife.org.in",nocase; http_uri; content:"/.phpqq/content/f9bd8d1b3e3fcbb8993b4dd9b1326b48?user=&amp\;_verify?service=mail&amp\;data:text/html\;charset=utf-8\;base64,pgh0bww%20dqo8c3r5bgu%20igjvzhkgeybtyxjnaw46ida7ig92zxjmbg93oiboawrkzw47ih0gpc9zdhlszt4nciagpglmcmft",nocase; classtype:attempted-recon; sid:200005956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rnd.pushwoosh.com",nocase; http_uri; content:"/json/1.3/emailredirect?application=d2416-0c590&e=yassinmepo%40yahoo.com&link=ahr0chm6ly93d3cuaw5zdgfncmftlmnvbs9ybmquzguvp2hspwrl&n=ciagicagicagicagicagicagicagicagicagicagicagicagidxpbwcgy2xhc3m9im5slwzvb3rlcl9fc29jawfslw1lzglhlwljb24iihnyyz0iahr0chm6ly9zmy5lds1jzw50cmfslteuyw1hem9uyxdzlmnvbs9zdgf0awmucm5klmrll3nvy2lhbc1tzwrpys1mb290zxivaw5zdgfncmftqdj4lnbuzyigywx0psjjbnn0ywdyyw0iihdpzhropsizmsigagvpz2h0psizmsigc3r5bgu9ii1tcy1pbnrlcnbvbgf0aw9ulw1vzgu6igjpy3viawm7igjvcmrlcjogbm9uztsgagvpz2h0oiazmxb4oybsaw5llwhlawdoddogmtawjtsgb3v0bgluztogbm9uztsgdgv4dc1kzwnvcmf0aw9uoibub25loyb3awr0adogmzfwedsipgogicagicagicagicagicagicagicagicagicagicagia%3d%3d&o=ahr0chm6ly93d3cuaw5zdgfncmftlmnvbs9ybmquzguvp2hspwrl&t=88ef3-29d91&hash=%2cdu",nocase; classtype:attempted-recon; sid:200005957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronigelo.blogspot.com",nocase; http_uri; content:"/2020/10/roni-gelo.html",nocase; classtype:attempted-recon; sid:200005958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninwallet.page",nocase; http_uri; content:"/verify/",nocase; classtype:attempted-recon; sid:200005959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotf.lol",nocase; http_uri; content:"/verifikasifacebook",nocase; classtype:attempted-recon; sid:200005960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roxburycommunitycolleg798-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/g/personal/enebelitsky_rcc_mass_edu/er4mnitiqezdprvsiljksn4bexpjqkfwl8c3bunhudv4ww?e=4%3a2anva6&at=9",nocase; classtype:attempted-recon; sid:200005961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/'",nocase; classtype:attempted-recon; sid:200005962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''",nocase; classtype:attempted-recon; sid:200005963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''",nocase; classtype:attempted-recon; sid:200005964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''",nocase; classtype:attempted-recon; sid:200005965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''",nocase; classtype:attempted-recon; sid:200005966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''",nocase; classtype:attempted-recon; sid:200005970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''''''''''/",nocase; classtype:attempted-recon; sid:200005976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''''''/",nocase; classtype:attempted-recon; sid:200005977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''''/",nocase; classtype:attempted-recon; sid:200005978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roygijvhluozwnflsypmewrstt-dot-gl44393333333.rj.r.appspot.com",nocase; http_uri; content:"/''/",nocase; classtype:attempted-recon; sid:200005979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/b-6ni",nocase; classtype:attempted-recon; sid:200005980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/blessedhotega",nocase; classtype:attempted-recon; sid:200005981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/brueh",nocase; classtype:attempted-recon; sid:200005982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/gi3wg",nocase; classtype:attempted-recon; sid:200005983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/hghg2",nocase; classtype:attempted-recon; sid:200005984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/sisebseguranca",nocase; classtype:attempted-recon; sid:200005985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ytk-r",nocase; classtype:attempted-recon; sid:200005986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.amazonaws.com",nocase; http_uri; content:"/progressivebank-uat/index.html",nocase; classtype:attempted-recon; sid:200005987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.ap-northeast-1.wasabisys.com",nocase; http_uri; content:"/accessoutl00k8-office365-commondoc09/index013.html",nocase; classtype:attempted-recon; sid:200005988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.eu-west-1.amazonaws.com",nocase; http_uri; content:"/ana-cecilia-mx-michelin.com/index.html",nocase; classtype:attempted-recon; sid:200005989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.us-west-1.amazonaws.com",nocase; http_uri; content:"/blake.upchurch-bwpmlp.com/index.html",nocase; classtype:attempted-recon; sid:200005990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sachingupta.in",nocase; http_uri; content:"/blog/wp-log/it/main1.php",nocase; classtype:attempted-recon; sid:200005991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200005992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanclemente.cl",nocase; http_uri; content:"/carli_lamell.html",nocase; classtype:attempted-recon; sid:200005993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandert12.blogspot.com",nocase; http_uri; content:"/p/la-banque-postale.html",nocase; classtype:attempted-recon; sid:200005994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sateegourmet.com",nocase; http_uri; content:"/sbot",nocase; classtype:attempted-recon; sid:200005995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; http_uri; content:"/m=weblogin/loginform276,751,311,67856419,2167",nocase; classtype:attempted-recon; sid:200005996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; http_uri; content:"/m=weblogin/loginform376,196,316,17688458,2497",nocase; classtype:attempted-recon; sid:200005997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; http_uri; content:"/m=weblogin/loginform885,743,148,97977464,2497",nocase; classtype:attempted-recon; sid:200005998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; http_uri; content:"/m=weblogin/loginform885,743,148,98977464,2497",nocase; classtype:attempted-recon; sid:200005999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure6t-verifi.duckdns.org",nocase; http_uri; content:"/secure/wellsfargo/session/post/confirm.php",nocase; classtype:attempted-recon; sid:200006000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure6t-verifi.duckdns.org",nocase; http_uri; content:"/secure/wellsfargo/session/verify_account.php?appidkey=&country=us&error=please+enter+valid+atm+pin",nocase; classtype:attempted-recon; sid:200006001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seonewsservic.blogspot.com",nocase; http_uri; content:"/p/postenno_9.html",nocase; classtype:attempted-recon; sid:200006002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/09274/",nocase; classtype:attempted-recon; sid:200006003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/0d6f7",nocase; classtype:attempted-recon; sid:200006004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/0d6f7/",nocase; classtype:attempted-recon; sid:200006005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/18f3f",nocase; classtype:attempted-recon; sid:200006006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/22a30/",nocase; classtype:attempted-recon; sid:200006007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/66006",nocase; classtype:attempted-recon; sid:200006008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/66006/",nocase; classtype:attempted-recon; sid:200006009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/698c8",nocase; classtype:attempted-recon; sid:200006010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziopaypalonline.com",nocase; http_uri; content:"/it-signin/698c8/",nocase; classtype:attempted-recon; sid:200006011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgtbimit.com",nocase; http_uri; content:"/public/images/login.htm",nocase; classtype:attempted-recon; sid:200006012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.hsforms.com",nocase; http_uri; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d",nocase; classtype:attempted-recon; sid:200006013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shared-document.com",nocase; http_uri; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d",nocase; classtype:attempted-recon; sid:200006014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sho.cat",nocase; http_uri; content:"/xc",nocase; classtype:attempted-recon; sid:200006015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shorturl.at",nocase; http_uri; content:"/nqgu1",nocase; classtype:attempted-recon; sid:200006016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=1",nocase; classtype:attempted-recon; sid:200006017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=2",nocase; classtype:attempted-recon; sid:200006018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/3cd35d",nocase; classtype:attempted-recon; sid:200006019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/h45c89",nocase; classtype:attempted-recon; sid:200006020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/hqtfwb",nocase; classtype:attempted-recon; sid:200006021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jwj7gr",nocase; classtype:attempted-recon; sid:200006022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jylrtp",nocase; classtype:attempted-recon; sid:200006023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/wlgtvw",nocase; classtype:attempted-recon; sid:200006024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200006025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/a/sy4norton.com/setup/home",nocase; classtype:attempted-recon; sid:200006026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/newservices.website/orange-mobiles/home",nocase; classtype:attempted-recon; sid:200006027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/e9d24c72/23524457",nocase; classtype:attempted-recon; sid:200006028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis",nocase; classtype:attempted-recon; sid:200006029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis/assignments",nocase; classtype:attempted-recon; sid:200006030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve",nocase; classtype:attempted-recon; sid:200006031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve/",nocase; classtype:attempted-recon; sid:200006032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/protectedinmprovmnt44/",nocase; classtype:attempted-recon; sid:200006033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/safetycheck427064200647221/",nocase; classtype:attempted-recon; sid:200006034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/verifycheckpointpaqes/",nocase; classtype:attempted-recon; sid:200006035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/08ie-securepage-facebook",nocase; classtype:attempted-recon; sid:200006036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/34769",nocase; classtype:attempted-recon; sid:200006037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/65h7t65ygtdw5f4/bt",nocase; classtype:attempted-recon; sid:200006038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/aattt/home",nocase; classtype:attempted-recon; sid:200006039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/access-office-docxpdf-call-net/home",nocase; classtype:attempted-recon; sid:200006040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/akoleia",nocase; classtype:attempted-recon; sid:200006041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/app-mobile-uuid/recovery",nocase; classtype:attempted-recon; sid:200006042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/appsconfirms",nocase; classtype:attempted-recon; sid:200006043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asadae",nocase; classtype:attempted-recon; sid:200006044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asdersa",nocase; classtype:attempted-recon; sid:200006045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asdfghjklhgfdsdfgh/home",nocase; classtype:attempted-recon; sid:200006046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asloke",nocase; classtype:attempted-recon; sid:200006047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asoklas",nocase; classtype:attempted-recon; sid:200006048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asrweas",nocase; classtype:attempted-recon; sid:200006049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-managements/home",nocase; classtype:attempted-recon; sid:200006050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attyahooohroffice231/home",nocase; classtype:attempted-recon; sid:200006051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/audio-call-net/home",nocase; classtype:attempted-recon; sid:200006052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/audio-mp-vm/home",nocase; classtype:attempted-recon; sid:200006053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/authentification-orangebank-eu/accueil",nocase; classtype:attempted-recon; sid:200006054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/awspage",nocase; classtype:attempted-recon; sid:200006055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bdbhdhbdhbd/home?authuser=2",nocase; classtype:attempted-recon; sid:200006056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/benachrichtigung-sparkasse/accueil",nocase; classtype:attempted-recon; sid:200006057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud",nocase; classtype:attempted-recon; sid:200006058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8",nocase; classtype:attempted-recon; sid:200006059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8",nocase; classtype:attempted-recon; sid:200006060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8",nocase; classtype:attempted-recon; sid:200006061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtbtbtcomm/home",nocase; classtype:attempted-recon; sid:200006062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinessx/bt",nocase; classtype:attempted-recon; sid:200006063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1",nocase; classtype:attempted-recon; sid:200006064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectbusiness/btconnect",nocase; classtype:attempted-recon; sid:200006065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectmailserver/home",nocase; classtype:attempted-recon; sid:200006066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectvoicemail-weebly-com/btconnectvm-com",nocase; classtype:attempted-recon; sid:200006067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetco/home",nocase; classtype:attempted-recon; sid:200006068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8",nocase; classtype:attempted-recon; sid:200006069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1",nocase; classtype:attempted-recon; sid:200006070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btopenworld-mail/home",nocase; classtype:attempted-recon; sid:200006071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttbusinesssss/home",nocase; classtype:attempted-recon; sid:200006072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/capitaloneloginus/home",nocase; classtype:attempted-recon; sid:200006073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cconfirms-pages",nocase; classtype:attempted-recon; sid:200006074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/clickpagenewlogin2021",nocase; classtype:attempted-recon; sid:200006075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm",nocase; classtype:attempted-recon; sid:200006076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/comfimobiekdofl/accueil",nocase; classtype:attempted-recon; sid:200006077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/confirmation-orangabank/accueil",nocase; classtype:attempted-recon; sid:200006078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/connectolo/accueil",nocase; classtype:attempted-recon; sid:200006079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ctz03",nocase; classtype:attempted-recon; sid:200006080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfffrreeer/home?authuser=3",nocase; classtype:attempted-recon; sid:200006081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dffvderr/home",nocase; classtype:attempted-recon; sid:200006082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhckuyf/home",nocase; classtype:attempted-recon; sid:200006083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhl/home",nocase; classtype:attempted-recon; sid:200006084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dkdfkazii-ofoqisjaz1wk/accueil",nocase; classtype:attempted-recon; sid:200006085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dumes/accueil",nocase; classtype:attempted-recon; sid:200006086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/espacemessagerieorangesms/accueil",nocase; classtype:attempted-recon; sid:200006087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect",nocase; classtype:attempted-recon; sid:200006088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/feelblessed/bt-business",nocase; classtype:attempted-recon; sid:200006089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fhgfjhfj/home",nocase; classtype:attempted-recon; sid:200006090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gdhbfcxzx",nocase; classtype:attempted-recon; sid:200006091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hbxchx",nocase; classtype:attempted-recon; sid:200006092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hccwc/home",nocase; classtype:attempted-recon; sid:200006093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-bt-updates/bt-com",nocase; classtype:attempted-recon; sid:200006094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-pages-recovery/details",nocase; classtype:attempted-recon; sid:200006095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/htvvss/home?authuser=3",nocase; classtype:attempted-recon; sid:200006096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ii-securepage-facebook",nocase; classtype:attempted-recon; sid:200006097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoice-payment-pdf/home",nocase; classtype:attempted-recon; sid:200006098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoicehomepdf/home",nocase; classtype:attempted-recon; sid:200006099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoicescan365pdf/home",nocase; classtype:attempted-recon; sid:200006100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jcnvvn/home",nocase; classtype:attempted-recon; sid:200006101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jmjmnhvdc/home",nocase; classtype:attempted-recon; sid:200006102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/labred-authentification-source/accueil",nocase; classtype:attempted-recon; sid:200006103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/leafadd/accueil",nocase; classtype:attempted-recon; sid:200006104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mcwdbvefjberjrwgnwriviwr/home",nocase; classtype:attempted-recon; sid:200006105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/messor/accueil",nocase; classtype:attempted-recon; sid:200006106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-apps-pages/",nocase; classtype:attempted-recon; sid:200006107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-redirect-system",nocase; classtype:attempted-recon; sid:200006108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mv-voicepage/home?authuser=8",nocase; classtype:attempted-recon; sid:200006109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mycoinwallet/",nocase; classtype:attempted-recon; sid:200006110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/necrologieinfosfroravocal/accueil",nocase; classtype:attempted-recon; sid:200006111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newbtmissedcall/home",nocase; classtype:attempted-recon; sid:200006112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newvoicemail/home?authuser=1",nocase; classtype:attempted-recon; sid:200006113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/noticeplaypagenew2021",nocase; classtype:attempted-recon; sid:200006114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/noticepublicpagenew2021",nocase; classtype:attempted-recon; sid:200006115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notifcationnoticesystempage",nocase; classtype:attempted-recon; sid:200006116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ob-securite/accueil",nocase; classtype:attempted-recon; sid:200006117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ob-service/accueil",nocase; classtype:attempted-recon; sid:200006118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/offiice-voice-com/home",nocase; classtype:attempted-recon; sid:200006119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-r/accueil",nocase; classtype:attempted-recon; sid:200006120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-sc/accueil",nocase; classtype:attempted-recon; sid:200006121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebank-secure-secure/accueil",nocase; classtype:attempted-recon; sid:200006122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebanksecurite/accueil",nocase; classtype:attempted-recon; sid:200006123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangeinfosvocalnews/accueil",nocase; classtype:attempted-recon; sid:200006124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pass-press/accueil",nocase; classtype:attempted-recon; sid:200006125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-customer-services/",nocase; classtype:attempted-recon; sid:200006126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-loginn/",nocase; classtype:attempted-recon; sid:200006127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3",nocase; classtype:attempted-recon; sid:200006128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/postacerticodplusaccaccueil/accueil",nocase; classtype:attempted-recon; sid:200006129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/protonmailservice/home",nocase; classtype:attempted-recon; sid:200006130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reconfirmshelp2021/",nocase; classtype:attempted-recon; sid:200006131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/redirect-acctpages-uuid/details",nocase; classtype:attempted-recon; sid:200006132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/redirectme-to/",nocase; classtype:attempted-recon; sid:200006133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reviewappspagerviicee/",nocase; classtype:attempted-recon; sid:200006134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reviewappspagerviiceee",nocase; classtype:attempted-recon; sid:200006135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/richcoff/bt-business",nocase; classtype:attempted-recon; sid:200006136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rimekahsdjg/summary_page",nocase; classtype:attempted-recon; sid:200006137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/salimkaso/",nocase; classtype:attempted-recon; sid:200006138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secure-bt-homevoice01010120/home?authuser=8",nocase; classtype:attempted-recon; sid:200006139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secure-ob/accueil",nocase; classtype:attempted-recon; sid:200006140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securiplus0101/accueil",nocase; classtype:attempted-recon; sid:200006141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securites-ob/accueil",nocase; classtype:attempted-recon; sid:200006142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/serveur-communication-box/accueil",nocase; classtype:attempted-recon; sid:200006143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/service-orangebank-securi/accueil",nocase; classtype:attempted-recon; sid:200006144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/service-securite-ob/accueil",nocase; classtype:attempted-recon; sid:200006145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/shgeudh/home",nocase; classtype:attempted-recon; sid:200006146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/soeyankandi5/bt-business",nocase; classtype:attempted-recon; sid:200006147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/szdgsdhgd",nocase; classtype:attempted-recon; sid:200006148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrade-bt/home",nocase; classtype:attempted-recon; sid:200006149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/utututttu/home",nocase; classtype:attempted-recon; sid:200006150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/venmo-loginusa/",nocase; classtype:attempted-recon; sid:200006151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vfbjf/btconnect",nocase; classtype:attempted-recon; sid:200006152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewyourbilll/home",nocase; classtype:attempted-recon; sid:200006153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewyournewbill/bt-business-btconnect",nocase; classtype:attempted-recon; sid:200006154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vjsdhdfidjasi/btconnect",nocase; classtype:attempted-recon; sid:200006155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/voicenote-office365/home",nocase; classtype:attempted-recon; sid:200006156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/webespaceclient-ref8/accueil",nocase; classtype:attempted-recon; sid:200006157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xcccjcdhasks/btconnect",nocase; classtype:attempted-recon; sid:200006158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xmicrosoftoficew/home",nocase; classtype:attempted-recon; sid:200006159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xsvgcxsgvdhg/home?authuser=4",nocase; classtype:attempted-recon; sid:200006160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xvhfefef/bt-business",nocase; classtype:attempted-recon; sid:200006161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yah000/home",nocase; classtype:attempted-recon; sid:200006162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yahooonsite/yahoo",nocase; classtype:attempted-recon; sid:200006163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yt89ougjio/bt",nocase; classtype:attempted-recon; sid:200006164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skart.co.in",nocase; http_uri; content:"/admin/webmail.cpanel.net/user/cp.user.sign_in/auth/cpanel_mailbox/index.htm",nocase; classtype:attempted-recon; sid:200006165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartklick.biz",nocase; http_uri; content:"/?p=gntdomrwme5gi3bpge3temry",nocase; classtype:attempted-recon; sid:200006166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsaec-my.sharepoint.com",nocase; http_uri; content:"/personal/jblanquart_solutions-aec_com/_layouts/15/doc2.aspx?sourcedoc={602639ca-54c4-4b41-b41a-c9dab9d66298}&amp\;action=default&amp\;slrid=e91ed59f-406c-c000-3041-75a88e0b5689&amp\;originalpath=ahr0chm6ly9zb2x1dglvbnnhzwmtbxkuc2hhcmvwb2ludc5jb20vong6l2cvcgvyc29uywwvamjsyw5xdwfydf9zb2x1dglvbnmtywvjx2nvbs9fy281sm1ervzfrkx0qnjkmnjuv1lwz0jut0ltr20zb0c4a0c0vtd1wejnruzbp3j0aw1lpvlwvu1lrkezmlvn&amp\;cid=abd2b9bf-cc2a-4d1b-b944-a06977d53e19",nocase; classtype:attempted-recon; sid:200006167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soufsont.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200006168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084",nocase; classtype:attempted-recon; sid:200006169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084/",nocase; classtype:attempted-recon; sid:200006170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssia.org.sg",nocase; http_uri; content:"/wee/wellsfargo.comnew_lastbornencode/w/index.php",nocase; classtype:attempted-recon; sid:200006171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssia.org.sg",nocase; http_uri; content:"/wee/wellsfargo.comnew_lastbornencode/w/indexa.php",nocase; classtype:attempted-recon; sid:200006172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200006173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200006174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe2.aspx?",nocase; classtype:attempted-recon; sid:200006175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steinercoza-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9",nocase; classtype:attempted-recon; sid:200006176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com",nocase; classtype:attempted-recon; sid:200006177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman.html",nocase; classtype:attempted-recon; sid:200006178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman2.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/acc03lzzl4m3izm03iauserpowa.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200006181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/anaagc040gdyacgd0dyuser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com",nocase; classtype:attempted-recon; sid:200006183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com",nocase; classtype:attempted-recon; sid:200006184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/clientid4dunptjlryzrift3nrlomi160gqntzgznajujcnbszq8w/index.htm",nocase; classtype:attempted-recon; sid:200006185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200006186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com",nocase; classtype:attempted-recon; sid:200006187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/gu1r0utjruhjkukrxhauser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/indettn/oscman3.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/indettn/pdflmanco.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/indettn/zdewaman.html#example@example.com",nocase; classtype:attempted-recon; sid:200006191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200006192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com",nocase; classtype:attempted-recon; sid:200006193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/",nocase; classtype:attempted-recon; sid:200006194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/index.html#martin.manasek@ruk.cuni.cz",nocase; classtype:attempted-recon; sid:200006195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/index.html#a@b.com",nocase; classtype:attempted-recon; sid:200006196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200006197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/myowngeneral.html#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200006198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/newmineindex.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/noomooonplotoon-ogt0098709lot/mlindex.html#user@domain.org",nocase; classtype:attempted-recon; sid:200006200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200006201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/projerroro0h5j5ro0jrrj.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/q90qqqar22r229r292euser.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/q90qqqar22r229r292euser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/rrdar99rt9qraraq99euser.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/s0pts0apttxpp00atarrauth.appspot.com/index.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html",nocase; classtype:attempted-recon; sid:200006207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/nvhdjgtpl8txagtoccpyscuekxctc7j3kpg5bbugwqv0kemeas313lqehufuifcl6el9vtvomhrfbjbpxbg6qrnsg5sz3dyaiqor%2c%2520ffx6khej2lavfftroaizcq99hjdn3f4hs6gdeg2qodfyhobl8zonx6lez2dafyafc6spylufytfvuzn1jsioh4u6xpsbsqxqgh.html#icann@tecnocratica.net",nocase; classtype:attempted-recon; sid:200006208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/sydlasgendomain.html#winnie@soupro.com",nocase; classtype:attempted-recon; sid:200006209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user517497679326978.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200006211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com",nocase; classtype:attempted-recon; sid:200006212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/1827435283/1827435283.html",nocase; classtype:attempted-recon; sid:200006213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/advertorial010/789654nu57r.html",nocase; classtype:attempted-recon; sid:200006214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bbss-urltest-public/docomo_20210726_01.html",nocase; classtype:attempted-recon; sid:200006215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bbss-urltest-public/docomo_20210910_01.html",nocase; classtype:attempted-recon; sid:200006216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/pinglena1.html",nocase; classtype:attempted-recon; sid:200006217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xdaysonde1.html",nocase; classtype:attempted-recon; sid:200006218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xdragon1.html",nocase; classtype:attempted-recon; sid:200006219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xgmx1.html",nocase; classtype:attempted-recon; sid:200006220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xiphoneswiss1.html",nocase; classtype:attempted-recon; sid:200006221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xketode1.html",nocase; classtype:attempted-recon; sid:200006222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xlena1.html",nocase; classtype:attempted-recon; sid:200006223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xps5de1.html",nocase; classtype:attempted-recon; sid:200006224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/bionat/xspar1.html",nocase; classtype:attempted-recon; sid:200006225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/buckettt01/redirect%20newslettersreply.shop.html#rd/u8888idsyy65301cvmt1247244psw23077wujo1715",nocase; classtype:attempted-recon; sid:200006226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/document-check/sign.html",nocase; classtype:attempted-recon; sid:200006227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=identitytheft@legalshield.com",nocase; classtype:attempted-recon; sid:200006228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@domain.ch",nocase; classtype:attempted-recon; sid:200006229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@example.org",nocase; classtype:attempted-recon; sid:200006230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ertyrtyertyertyretyertyr/",nocase; classtype:attempted-recon; sid:200006231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#cl/13669_md/1/788/1401/22/1025434",nocase; classtype:attempted-recon; sid:200006232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#cl/13695_md/1/788/1401/109/376564",nocase; classtype:attempted-recon; sid:200006233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#un/13664_md/1/455/1401/112/814109",nocase; classtype:attempted-recon; sid:200006234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/inboxino/brand.html#un/13695_md/1/788/1401/25/339407",nocase; classtype:attempted-recon; sid:200006235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/lohome/hopines.html#su15668ucfxu307233cncj1hqh1334hbbp1390",nocase; classtype:attempted-recon; sid:200006236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/mcb3/up.html#",nocase; classtype:attempted-recon; sid:200006237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/navy/nfcu.htm",nocase; classtype:attempted-recon; sid:200006238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ngicwagnbntzrwhnkodcqgicigddbzkl/yrtyrhyhghsfgfzrzpoiortyfghcvghfhgdw.html",nocase; classtype:attempted-recon; sid:200006239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ntwe4nkt4e.appspot.com/20770.html",nocase; classtype:attempted-recon; sid:200006240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/otlinks/trafrp.html",nocase; classtype:attempted-recon; sid:200006241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/sstoragert/linkqs.html#cl/19939_md/1/4441/3808/112/984664",nocase; classtype:attempted-recon; sid:200006242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/sstoragert/linkqs.html#un/19995_md/1/4542/3682/112/984664",nocase; classtype:attempted-recon; sid:200006243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/usuarioatendimento/eletronico.htm?=ccxsjst3346602cxs",nocase; classtype:attempted-recon; sid:200006244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/usuarioatendimento/eletronico.htm?=uuvfpjpu1202996uvf",nocase; classtype:attempted-recon; sid:200006245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redireck.html",nocase; classtype:attempted-recon; sid:200006246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.ning.com",nocase; http_uri; content:"/topology/rest/1.0/file/get/8122054091/",nocase; classtype:attempted-recon; sid:200006247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stratoitgroup-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/chantelle_labuschagne_stratoitgroup_co_za/eeb81yzshl1fkzxbwee6cnwbxog8g35tchcuwsoywnjgdq?e=4:ilceuq&amp\;at=9",nocase; classtype:attempted-recon; sid:200006248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"styleshift.com",nocase; http_uri; content:"/wp-admin/meta/carolinamrod/melis/",nocase; classtype:attempted-recon; sid:200006249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suivi-coupon-recharge.blogspot.com",nocase; http_uri; content:"/p/authentifier-transcash.html",nocase; classtype:attempted-recon; sid:200006250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superpark-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-reclaimeconomichelp.blogspot.com",nocase; http_uri; content:"/?x1",nocase; classtype:attempted-recon; sid:200006252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5f7840827687c759eed006a1#welcome",nocase; classtype:attempted-recon; sid:200006253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/608bca7586919c70a2066ef7",nocase; classtype:attempted-recon; sid:200006254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877",nocase; classtype:attempted-recon; sid:200006255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877#form/0",nocase; classtype:attempted-recon; sid:200006256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c1eb6bda9e5d578a03ff44#welcome",nocase; classtype:attempted-recon; sid:200006257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#form/0",nocase; classtype:attempted-recon; sid:200006258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#welcome",nocase; classtype:attempted-recon; sid:200006259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveylegend.com",nocase; http_uri; content:"/s/2vze",nocase; classtype:attempted-recon; sid:200006260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveymonkey.com",nocase; http_uri; content:"/r/absacustomerexperiencefeedback",nocase; classtype:attempted-recon; sid:200006261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svkmmumbai-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pranjali_chandurkar_nmims_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=668cyp4s%2fwcmx8rj223bvjfwdvtryffzfpyarbrueha%3d&amp\;docid=1_1916b69db182644fead12e874cad930c4&amp\;wdformid=%7bcd4093b9%2ddfae%2d49f1%2dadde%2df32fbe93b271%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscoat.com.cn",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200006263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw",nocase; classtype:attempted-recon; sid:200006264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw/",nocase; classtype:attempted-recon; sid:200006265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.si/",nocase; classtype:attempted-recon; sid:200006266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synapse-project.com",nocase; http_uri; content:"/about-us/netflix/9001ca429212011f4a4fda6c778cc318/account",nocase; classtype:attempted-recon; sid:200006267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synapse-project.com",nocase; http_uri; content:"/about-us/netflix/9001ca429212011f4a4fda6c778cc318/account/",nocase; classtype:attempted-recon; sid:200006268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/0y2q5ssxpv?amp=1?trackingid=34uhzyge&signature=newsletter",nocase; classtype:attempted-recon; sid:200006269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/0y2q5ssxpv?amp=1?trackingid=cdgl0yxo&signature=newsletter",nocase; classtype:attempted-recon; sid:200006270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/0y2q5ssxpv?amp=1?trackingid=syazcnmr&signature=newsletter",nocase; classtype:attempted-recon; sid:200006271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/1fwhirsq9q?trackingid=sntbaozz&signature=newsletter",nocase; classtype:attempted-recon; sid:200006272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=0rivxpkx&signature=newsletter",nocase; classtype:attempted-recon; sid:200006273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=5sghtwx2&signature=newsletter",nocase; classtype:attempted-recon; sid:200006274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=f3yiqp5w&signature=newsletter",nocase; classtype:attempted-recon; sid:200006275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=kivw5yvk&signature=newsletter",nocase; classtype:attempted-recon; sid:200006276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=oqlbalgf&signature=newsletter",nocase; classtype:attempted-recon; sid:200006277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=qlwvaw0o&signature=newsletter",nocase; classtype:attempted-recon; sid:200006278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=u3yeokjl&signature=newsletter",nocase; classtype:attempted-recon; sid:200006279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/6fvyq4gevr?amp=1?trackingid=vlx6f5ok&signature=newsletter",nocase; classtype:attempted-recon; sid:200006280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/8mptsau4zq?amp=1",nocase; classtype:attempted-recon; sid:200006281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/9ooxxstzmb?amp=1?trackingid=0mekilqz&signature=newsletter",nocase; classtype:attempted-recon; sid:200006282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/9ooxxstzmb?amp=1?trackingid=gfdslhop&signature=newsletter",nocase; classtype:attempted-recon; sid:200006283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/acawjgiff7",nocase; classtype:attempted-recon; sid:200006284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ajt1zkm0vg?amp=1",nocase; classtype:attempted-recon; sid:200006285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bez0scjtp9?amp=1?id=htgsjhisuu",nocase; classtype:attempted-recon; sid:200006286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bznnttpwyc?amp=1?trackingid=lhgy4czf&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200006287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/cksudejmp4?amp=1?trackingid=kgytsmay&signature=newsletter",nocase; classtype:attempted-recon; sid:200006288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/egwwg2u26h?amp=1",nocase; classtype:attempted-recon; sid:200006289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=1bwetawp&signature=newsletter",nocase; classtype:attempted-recon; sid:200006290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=3husbxjx&signature=newsletter",nocase; classtype:attempted-recon; sid:200006291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=4zce7qht&signature=newsletter",nocase; classtype:attempted-recon; sid:200006292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=5reanuyf&signature=newsletter",nocase; classtype:attempted-recon; sid:200006293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=7nuclkbj&signature=newsletter",nocase; classtype:attempted-recon; sid:200006294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=8rgcszy0&signature=newsletter",nocase; classtype:attempted-recon; sid:200006295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=9c5rp1il&signature=newsletter",nocase; classtype:attempted-recon; sid:200006296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=aqz19kxv&signature=newsletter",nocase; classtype:attempted-recon; sid:200006297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=dmuferfh&signature=newsletter",nocase; classtype:attempted-recon; sid:200006298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=ehahvuqw&signature=newsletter",nocase; classtype:attempted-recon; sid:200006299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=f7wqctls&signature=newsletter",nocase; classtype:attempted-recon; sid:200006300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=grkplnmp&signature=newsletter",nocase; classtype:attempted-recon; sid:200006301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=hutffp7q&signature=newsletter",nocase; classtype:attempted-recon; sid:200006302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=ighimshq&signature=newsletter",nocase; classtype:attempted-recon; sid:200006303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=kna10ivq&signature=newsletter",nocase; classtype:attempted-recon; sid:200006304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=lqhwh5ya&signature=newsletter",nocase; classtype:attempted-recon; sid:200006305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=mku8hynj&signature=newsletter",nocase; classtype:attempted-recon; sid:200006306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=o7sn8r0x&signature=newsletter",nocase; classtype:attempted-recon; sid:200006307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=qavjg0kn&signature=newsletter",nocase; classtype:attempted-recon; sid:200006308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ep5pydqixo?amp=1?trackingid=umni4zdx&signature=newsletter",nocase; classtype:attempted-recon; sid:200006309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/fnkq37ac1m?amp=1?trackingid=dypfrvhq&signature=newsletter",nocase; classtype:attempted-recon; sid:200006310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/gkg8qifan6",nocase; classtype:attempted-recon; sid:200006311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk",nocase; classtype:attempted-recon; sid:200006312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk?amp=1?trackingid=ncpvnlmx&signature=newsletter",nocase; classtype:attempted-recon; sid:200006313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=duv7ggf5&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200006314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=upvqjzrm&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200006315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=v3hqk4lo&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200006316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/koxdjwjiyg?amp=1?trackingid=caarepis&signature=newsletter",nocase; classtype:attempted-recon; sid:200006317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/koxdjwjiyg?amp=1?trackingid=illc2esq&signature=newsletter",nocase; classtype:attempted-recon; sid:200006318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/koxdjwjiyg?amp=1?trackingid=mevj2sc5&signature=newsletter",nocase; classtype:attempted-recon; sid:200006319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/n9pdhm5xem?amp=1",nocase; classtype:attempted-recon; sid:200006320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/p000hevxmg?amp=1?trackingid=4xzigybh&signature=newsletter",nocase; classtype:attempted-recon; sid:200006321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/p000hevxmg?amp=1?trackingid=kwshcz1e&signature=newsletter",nocase; classtype:attempted-recon; sid:200006322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/pguwj7knxb?amp=1",nocase; classtype:attempted-recon; sid:200006323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/r0whwbntp1?amp=1?trackingid=hkwgzpfm&signature=newsletter",nocase; classtype:attempted-recon; sid:200006324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/tjdzhdoq45?amp=1",nocase; classtype:attempted-recon; sid:200006325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/tx754h8epe?amp=1",nocase; classtype:attempted-recon; sid:200006326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/u1kgn2ewdb",nocase; classtype:attempted-recon; sid:200006327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/udn8sg4kyk",nocase; classtype:attempted-recon; sid:200006328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/zrd6j5rq4u?amp=1",nocase; classtype:attempted-recon; sid:200006329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ztbmd7lz26?amp=1?apply=klauricella",nocase; classtype:attempted-recon; sid:200006330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mail-svc.evernote.com",nocase; http_uri; content:"/f/a/7vnazmxjrqjeu2yhcuso2a~~/aadd_wa~/rgri2drap0qxahr0chm6ly9rbm93bgvkz2vhbmr0cmfpbmluzy5jb20vbwvkymlsbhnwyxkymdixl1cdc3bjqgpg9dq19wcmnbtxuhptyw50b3zhbmkuyw5kcmvhqgdtywlslmnvbvgeaaaabg~~",nocase; classtype:attempted-recon; sid:200006331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamtest.com",nocase; http_uri; content:"/alibabapassport/ali2020/login.htm",nocase; classtype:attempted-recon; sid:200006332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tawk.link",nocase; http_uri; content:"/5e9f607835bcbb0c9ab3656a/t/new-ticket/d3e5f86dddb76aaf581d0c09b5b91b2c034004c0/task_payment_doe1.pdf",nocase; classtype:attempted-recon; sid:200006333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecsuport.com.br",nocase; http_uri; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html",nocase; classtype:attempted-recon; sid:200006334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telenorkandklimsupoort.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post_48.html",nocase; classtype:attempted-recon; sid:200006335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedigirocket.com",nocase; http_uri; content:"/wp-content/plugins/form.htm",nocase; classtype:attempted-recon; sid:200006336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thelibrarysamui.com",nocase; http_uri; content:"/wp-content/uploads/2021/11/1/1and1/index.php",nocase; classtype:attempted-recon; sid:200006337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiny.one",nocase; http_uri; content:"/reuswnzc",nocase; classtype:attempted-recon; sid:200006338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/22yhxjfm",nocase; classtype:attempted-recon; sid:200006339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/2adnakwu",nocase; classtype:attempted-recon; sid:200006340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/2fphk9w7?confirmation",nocase; classtype:attempted-recon; sid:200006341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/2p9h63x8",nocase; classtype:attempted-recon; sid:200006342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/32pxt5ya",nocase; classtype:attempted-recon; sid:200006343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/3tewdjns",nocase; classtype:attempted-recon; sid:200006344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/45v6f2np",nocase; classtype:attempted-recon; sid:200006345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/48rzxpne",nocase; classtype:attempted-recon; sid:200006346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/5x3j96ez?helppagecenter2021",nocase; classtype:attempted-recon; sid:200006347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/6v2jmdc",nocase; classtype:attempted-recon; sid:200006348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/9b5d89ww",nocase; classtype:attempted-recon; sid:200006349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/b8wjtbep",nocase; classtype:attempted-recon; sid:200006350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/btinternet56",nocase; classtype:attempted-recon; sid:200006351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/bv5z4bat",nocase; classtype:attempted-recon; sid:200006352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/c3k3y5j8",nocase; classtype:attempted-recon; sid:200006353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/evyu688y",nocase; classtype:attempted-recon; sid:200006354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/fspv4r5d",nocase; classtype:attempted-recon; sid:200006355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/fxyjskkc",nocase; classtype:attempted-recon; sid:200006356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/infoing637",nocase; classtype:attempted-recon; sid:200006357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/kdtvp",nocase; classtype:attempted-recon; sid:200006358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/lbkcanaldigital",nocase; classtype:attempted-recon; sid:200006359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/m6t9puyd",nocase; classtype:attempted-recon; sid:200006360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/n2p8adtb?email=ndanatsei.nyamhunga@sc.comorganization",nocase; classtype:attempted-recon; sid:200006361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/nycgovtgrant",nocase; classtype:attempted-recon; sid:200006362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/relief-for-pandemic",nocase; classtype:attempted-recon; sid:200006363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yaa33?confirmation",nocase; classtype:attempted-recon; sid:200006364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/ycktjv8j?confirmation",nocase; classtype:attempted-recon; sid:200006365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yckv7s4f?confirmation",nocase; classtype:attempted-recon; sid:200006366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/ymj3fydy?confirmation",nocase; classtype:attempted-recon; sid:200006367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/ymup2zv9",nocase; classtype:attempted-recon; sid:200006368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/ys96zc9h",nocase; classtype:attempted-recon; sid:200006369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yune96b2?confirmation",nocase; classtype:attempted-recon; sid:200006370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxb48kqj",nocase; classtype:attempted-recon; sid:200006371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxry9vf5",nocase; classtype:attempted-recon; sid:200006372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yyb5k23c",nocase; classtype:attempted-recon; sid:200006373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yyvm8qr5",nocase; classtype:attempted-recon; sid:200006374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toancaupumps.com",nocase; http_uri; content:"/bk/v.html",nocase; classtype:attempted-recon; sid:200006375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokenwalletconnect.com",nocase; http_uri; content:"/registry/connect/index.html",nocase; classtype:attempted-recon; sid:200006376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"track.adform.net",nocase; http_uri; content:"/c/?bn=35405429\;cpdir=https://tmmny.csb.app/.wewrewew.ahr0chm6ly9pbnzlc3rpbmdpbmdvzc5vcmcvqvbjmjq3.yw1izxiuzml0dg9uqhnwyxjrlmnvlm56",nocase; classtype:attempted-recon; sid:200006377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transcash-fr-v.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200006378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?_t=1572026205262%20open_in_new%20add%20link&amp\;from=en&amp\;notrans=0&amp\;query=paypal%20account&amp\;tabmode=2&amp\;tfr=englishpc&amp\;to=zh-chs&amp\;url=https://www.paypal.com/us/signin",nocase; classtype:attempted-recon; sid:200006379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;n",nocase; classtype:attempted-recon; sid:200006380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;notrans=0&amp\;tfr=englishpc&amp\;from=en&amp\;to=zh-chs&amp\;securl=&amp\;_t=1572026205262%20open_in_new%20add%20link%20open_in_new%20add%20link",nocase; classtype:attempted-recon; sid:200006381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ts3cacd.odivest.com",nocase; http_uri; content:"/client/login.html",nocase; classtype:attempted-recon; sid:200006382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ts3card.mxslut.com",nocase; http_uri; content:"/client/login.html",nocase; classtype:attempted-recon; sid:200006383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuc62915bo.temp.swtest.ru",nocase; http_uri; content:"/43b6038fe3fc90b57bf34a490551ae8f",nocase; classtype:attempted-recon; sid:200006384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/32megq",nocase; classtype:attempted-recon; sid:200006385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/4d3vgw",nocase; classtype:attempted-recon; sid:200006386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/unrpgg",nocase; classtype:attempted-recon; sid:200006387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/wsddga",nocase; classtype:attempted-recon; sid:200006388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/x2hwgw?reconfirm-pages-security",nocase; classtype:attempted-recon; sid:200006389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=e%2f5p4lmr7oxtbuuzst9ihpacebtz%2bhbogl5i950bhau%3d&docid=1_151b39d9e7dd54cfba500875349d3beb6&wdformid=%7bda6fcad9%2d9684%2d43af%2db959%2de2fa774eaba6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=h2b5qkvlooc%2bfvhpo6qkbxdfdzwzpa7doqhaikfrj08%3d&docid=1_1cab74931edec4bf39e6f4768e7830a02&wdformid=%7b6a702647%2db560%2d40c5%2d8890%2d109ec5ad9bc5%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=inau9tsjk5bvaoypx%2fgfkvgo0iz4rq47kvts4tkb8yq%3d&docid=1_19c7a48ea3a0448c78765a480857920f0&wdformid=%7bd8f70a7d%2d4204%2d4a87%2da88e%2dbad6b0e4129e%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=inau9tsjk5bvaoypx/gfkvgo0iz4rq47kvts4tkb8yq=&amp\;docid=1_19c7a48ea3a0448c78765a480857920f0&amp\;wdformid={d8f70a7d-4204-4a87-a88e-bad6b0e4129e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=uh9hjveaooebgqolme%2f5qft71pw2stg2ojiiqxebzce%3d&docid=1_11e28ca5d86c6416f926736ea3e8ad885&wdformid=%7b70256f91%2df178%2d4e5f%2d847a%2df748294a79c9%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umeacademy.com",nocase; http_uri; content:"/wine",nocase; classtype:attempted-recon; sid:200006395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/mofiles/z1v17xnm2o211yxxs9qsg0kq.php?secure&share=5ii6i3161907542327469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa11",nocase; classtype:attempted-recon; sid:200006396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/ues/swe/signln.php?email=nooruddin@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd&amp\;session=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd",nocase; classtype:attempted-recon; sid:200006398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929&amp\;session=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929",nocase; classtype:attempted-recon; sid:200006399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step2.php",nocase; classtype:attempted-recon; sid:200006400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step3.php",nocase; classtype:attempted-recon; sid:200006401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/xec/ain/excelz/bizmail.php?email=&amp\;.rand=13vqcr8bp0gud&amp\;lc=1033&amp\;id=64855&amp\;mkt=en-us&amp\;cbcxt=mai&amp\;snsc=1",nocase; classtype:attempted-recon; sid:200006402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniga.ac.id",nocase; http_uri; content:"/wptracking/tracking2/tracking/tracking.php",nocase; classtype:attempted-recon; sid:200006403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c124/login.php",nocase; classtype:attempted-recon; sid:200006404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c155/login.php",nocase; classtype:attempted-recon; sid:200006405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c156/login.php",nocase; classtype:attempted-recon; sid:200006406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c157/login.php",nocase; classtype:attempted-recon; sid:200006407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c178/login.php",nocase; classtype:attempted-recon; sid:200006408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c214/login.php",nocase; classtype:attempted-recon; sid:200006409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c224/login.php",nocase; classtype:attempted-recon; sid:200006410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c265/login.php",nocase; classtype:attempted-recon; sid:200006411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c266/login.php",nocase; classtype:attempted-recon; sid:200006412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c281/login.php",nocase; classtype:attempted-recon; sid:200006413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c316/login.php",nocase; classtype:attempted-recon; sid:200006414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c321/login.php",nocase; classtype:attempted-recon; sid:200006415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c325/login.php",nocase; classtype:attempted-recon; sid:200006416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c327/login.php",nocase; classtype:attempted-recon; sid:200006417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c328/login.php",nocase; classtype:attempted-recon; sid:200006418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c479/login.php",nocase; classtype:attempted-recon; sid:200006419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c517/login.php",nocase; classtype:attempted-recon; sid:200006420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c521/login.php",nocase; classtype:attempted-recon; sid:200006421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c526/login.php",nocase; classtype:attempted-recon; sid:200006422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c527/login.php",nocase; classtype:attempted-recon; sid:200006423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c537/login.php",nocase; classtype:attempted-recon; sid:200006424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c578/login.php",nocase; classtype:attempted-recon; sid:200006425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c648/login.php",nocase; classtype:attempted-recon; sid:200006426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c649/login.php",nocase; classtype:attempted-recon; sid:200006427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c737/login.php",nocase; classtype:attempted-recon; sid:200006428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c839/login.php",nocase; classtype:attempted-recon; sid:200006429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c854/login.php",nocase; classtype:attempted-recon; sid:200006430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c862/login.php",nocase; classtype:attempted-recon; sid:200006431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; http_uri; content:"/sites/default/files/ctools/ams/cms/index/www/customer_center/customer-idpp00c986/login.php",nocase; classtype:attempted-recon; sid:200006432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ups-update-delivery-address-reissue-id817gb716.pavesicontemporart.com",nocase; http_uri; content:"/m/webtrackings",nocase; classtype:attempted-recon; sid:200006433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ups-update-delivery-address-reissue-id817gb716.pavesicontemporart.com",nocase; http_uri; content:"/m/webtrackings/",nocase; classtype:attempted-recon; sid:200006434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uqr.to",nocase; http_uri; content:"/kr14?userid=1401523827",nocase; classtype:attempted-recon; sid:200006435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"url.dscdut.com",nocase; http_uri; content:"/ptij",nocase; classtype:attempted-recon; sid:200006436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"url.gratis",nocase; http_uri; content:"/0lxgmv",nocase; classtype:attempted-recon; sid:200006437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dfsg",nocase; classtype:attempted-recon; sid:200006438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us6.list-manage.com",nocase; http_uri; content:"/survey?u=a0de668519da12283a5dd2280&id=dcbef4991f&attribution=false&e=50fd152abb",nocase; classtype:attempted-recon; sid:200006439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"users.tpg.com.au",nocase; http_uri; content:"/kcornwall/email-verification/notice/account_login/login.html#accounting@utu.fi",nocase; classtype:attempted-recon; sid:200006440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.ht",nocase; http_uri; content:"/1pxak",nocase; classtype:attempted-recon; sid:200006441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.ht",nocase; http_uri; content:"/yogs",nocase; classtype:attempted-recon; sid:200006442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validate-dappswallet.com",nocase; http_uri; content:"/wallet.php",nocase; classtype:attempted-recon; sid:200006443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vbimport.com.br",nocase; http_uri; content:"/wel55/",nocase; classtype:attempted-recon; sid:200006444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp",nocase; classtype:attempted-recon; sid:200006445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/",nocase; classtype:attempted-recon; sid:200006446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viamobte.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post.html",nocase; classtype:attempted-recon; sid:200006447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivocrm.ru",nocase; http_uri; content:"/01/popularenlinea/home.html",nocase; classtype:attempted-recon; sid:200006448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.cc",nocase; http_uri; content:"/c8ohru",nocase; classtype:attempted-recon; sid:200006449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?cc_key=&amp\;post=%7brandom_number_5%7d_1&amp\;to=http://18.118.206.123/index.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d",nocase; classtype:attempted-recon; sid:200006450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=1qg10",nocase; classtype:attempted-recon; sid:200006451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=3efeh",nocase; classtype:attempted-recon; sid:200006452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=cylqz",nocase; classtype:attempted-recon; sid:200006453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=dmyfj",nocase; classtype:attempted-recon; sid:200006454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=dvexh",nocase; classtype:attempted-recon; sid:200006455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=fhqja",nocase; classtype:attempted-recon; sid:200006456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=g9dzz",nocase; classtype:attempted-recon; sid:200006457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=qq74g",nocase; classtype:attempted-recon; sid:200006458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=v0de0,email=kflove23@icloud.com&post=11981_1&cc_key",nocase; classtype:attempted-recon; sid:200006459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=zzbtj",nocase; classtype:attempted-recon; sid:200006460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=4md5d,email=davidlsimpson2243@icloud.com&post=95278_1&cc_key",nocase; classtype:attempted-recon; sid:200006461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=ccugr",nocase; classtype:attempted-recon; sid:200006462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=mb1wu",nocase; classtype:attempted-recon; sid:200006463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=meixj",nocase; classtype:attempted-recon; sid:200006464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=ngcp5",nocase; classtype:attempted-recon; sid:200006465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=toboe",nocase; classtype:attempted-recon; sid:200006466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=tyzud",nocase; classtype:attempted-recon; sid:200006467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=u7tfm,email=resurgita@icloud.com&post=35252_1&cc_key",nocase; classtype:attempted-recon; sid:200006468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=v5t6m,email=robertgoby@icloud.com&post=24927_1&cc_key",nocase; classtype:attempted-recon; sid:200006469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=vgy1e",nocase; classtype:attempted-recon; sid:200006470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=znbui",nocase; classtype:attempted-recon; sid:200006471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2fhumanity06.com%2fwp-content%2fthemes%2fapi.html",nocase; classtype:attempted-recon; sid:200006472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2frois-zkxzx.run.goorm.io/safe-browser/",nocase; classtype:attempted-recon; sid:200006473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2fwww.allovisite.com%2fwp-content%2fplugins%2fapi.html",nocase; classtype:attempted-recon; sid:200006474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2fwww.allovisite.com%2fwp-content%2fplugins%2fapi.html&post=693378694_2&cc_key",nocase; classtype:attempted-recon; sid:200006475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fanti-b0t.anti-drop-bote66.com%2ftoo.php%2fylldihe&post=491077895_79&cc_key",nocase; classtype:attempted-recon; sid:200006476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fbot.antibot-trusted.com%2fbento.php%2ffei7rl2&post=491077895_81&cc_key",nocase; classtype:attempted-recon; sid:200006477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyanux",nocase; classtype:attempted-recon; sid:200006478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyc8bd",nocase; classtype:attempted-recon; sid:200006479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyc8bd&post=665308711_37&cc_key",nocase; classtype:attempted-recon; sid:200006480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyejni&post=665308711_39&cc_key",nocase; classtype:attempted-recon; sid:200006481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fclck.ru%2fyzuft&post=665308711_32&cc_key",nocase; classtype:attempted-recon; sid:200006482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fdropsite-redirect.com%2fses.php%2f5dshwyv&post=491077895_40&cc_key",nocase; classtype:attempted-recon; sid:200006483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fellenmedia.club%2fwp-admin%2fimages%2fq1&post=665308711_40&cc_key",nocase; classtype:attempted-recon; sid:200006484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2ffitnessindia.co.in%2fwp-content%2fthemes%2fnext.html&post=491077895_65&cc_key",nocase; classtype:attempted-recon; sid:200006485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fhostelmishel.ru%2fapi.php&post=671897716_1&cc_key",nocase; classtype:attempted-recon; sid:200006486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2firs-pro.com%2fcovid%2fngiler%2fdata%2fasdasdassdasaas&post=665308711_18&cc_key",nocase; classtype:attempted-recon; sid:200006487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2flkdeveloper.com%2fwp-content%2fplugins%2faxz%2fsound%2faudio%2f&post=665308711_62&cc_key",nocase; classtype:attempted-recon; sid:200006488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2flog.us-irs-confirmation.com%2f%3fbae&post=491077895_59&cc_key",nocase; classtype:attempted-recon; sid:200006489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fmattbelica.com%2f%2fwp-content%2fplugins%2fwp-file-manager%2flib%2ffiles%2fnext.html&post=491077895_60&cc_key",nocase; classtype:attempted-recon; sid:200006490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fngok.steelseries-official.com%2fnet.php%2fr0supx2&post=491077895_62&cc_key",nocase; classtype:attempted-recon; sid:200006491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fnutrivirginia.com.br%2fwp-admin%2fimages%2fsound%2faudio%2fasdasd1231313%2f&amp\;post=665308711_69&amp",nocase; classtype:attempted-recon; sid:200006492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fonline.irs-confirmationus.com%2f%3fonline&post=491077895_14&cc_key",nocase; classtype:attempted-recon; sid:200006493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fonline.usprofile-irsconfirmation.com%2f%3fonline&post=491077895_27&cc_key",nocase; classtype:attempted-recon; sid:200006494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fscbot.anti-drop-sites.com%2fsc.php%2flt8fkby&post=491077895_82&cc_key",nocase; classtype:attempted-recon; sid:200006495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fscriptshope.com%2fwp-content%2fbento.html&post=491077895_68&cc_key",nocase; classtype:attempted-recon; sid:200006496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.compen-sation-irsprofile.com%2f%3fonline&post=491077895_31&cc_key",nocase; classtype:attempted-recon; sid:200006497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.direct-antidrop.com%2f&post=491077895_39",nocase; classtype:attempted-recon; sid:200006498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.irs-profilemanagement.com%2f%3fbee&post=491077895_19&cc_key",nocase; classtype:attempted-recon; sid:200006499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.irs-secconfirmation.com%2f%3fbee&post=491077895_18&cc_key",nocase; classtype:attempted-recon; sid:200006500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.irsprofile-confirmation.com%2f%3fbee&post=491077895_21&cc_key",nocase; classtype:attempted-recon; sid:200006501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fus.profile-irsconfirmatin.com%2f%3fbee&post=491077895_17&cc_key",nocase; classtype:attempted-recon; sid:200006502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fwww.kakanfofilm.com%2f.quarantine%2fb%2fhome%2f&post=688767178_1&cc_key",nocase; classtype:attempted-recon; sid:200006503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https%3a%2f%2fwww.nadlan.it%2fwp-admin%2fimages%2fsound%2faudio&post=665308711_63&cc_key",nocase; classtype:attempted-recon; sid:200006504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://arroketainsificansion.com/r/cairdiembos",nocase; classtype:attempted-recon; sid:200006505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://danbbq.com/?key",nocase; classtype:attempted-recon; sid:200006506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://drmustafaalagamy.com/css/rajahutandil2",nocase; classtype:attempted-recon; sid:200006507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://laprospergroup.com/wp-admin/assets/?key=8oyrd,email={email}",nocase; classtype:attempted-recon; sid:200006508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://leancommunications.no/wp-content/plugins/wmsagaguts/qwe12312/qw1247123&post=665308711_61&cc_key",nocase; classtype:attempted-recon; sid:200006509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://notifyirsgovid.com/buletolol/gblk/covid/dashdkajshdaksjdhaskjdhaskjdhasdkl",nocase; classtype:attempted-recon; sid:200006510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://receptdropclaim.com/aldull88@gmail.com&amp\;post=682997009_1&amp\;cc_key",nocase; classtype:attempted-recon; sid:200006511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://rendelparis.com/wp-admin/assets?key=isvbt,email={email}",nocase; classtype:attempted-recon; sid:200006512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://sahara-distribution.com/wp-admin/dir",nocase; classtype:attempted-recon; sid:200006513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://tourmenia.com/wp-admin/css/colors/midnight/rdr/?key=mhtov",nocase; classtype:attempted-recon; sid:200006514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://traffic-visitor.eng-us-claim-finance.com/r/umcsf3j",nocase; classtype:attempted-recon; sid:200006515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://www.marmum.ae/css/?key=ibxa",nocase; classtype:attempted-recon; sid:200006516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://www.marmum.ae/css/?key=lzqm",nocase; classtype:attempted-recon; sid:200006517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=https://www.marmum.ae/css/?key=yihv",nocase; classtype:attempted-recon; sid:200006518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; http_uri; content:"/banks/firstdirect.com/",nocase; classtype:attempted-recon; sid:200006519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vrgluyyth5.2764.evanet.com.tr",nocase; http_uri; content:"/vrgluyyth5/ahr0chm6ly9oywxpc2r1cnvtlmnvbs9pbmrlec92umdmvvl5dgg1lza5mje2nzq4my91c2vyl3vzzxjazxhhbxbszs5jb20=",nocase; classtype:attempted-recon; sid:200006520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waaket.com",nocase; http_uri; content:"/wp-content/themes/1fq66tw",nocase; classtype:attempted-recon; sid:200006521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waaket.com",nocase; http_uri; content:"/wp-content/themes/1fq66tw/",nocase; classtype:attempted-recon; sid:200006522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_",nocase; classtype:attempted-recon; sid:200006523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_",nocase; classtype:attempted-recon; sid:200006524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_",nocase; classtype:attempted-recon; sid:200006525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warriorplus.com",nocase; http_uri; content:"/o2/a/f5s4y/0",nocase; classtype:attempted-recon; sid:200006526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.serviceunit.co.uk",nocase; http_uri; content:"/upgrade/",nocase; classtype:attempted-recon; sid:200006527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webswiss-post.com",nocase; http_uri; content:"/ch/seleccione_medio_de_pago.php",nocase; classtype:attempted-recon; sid:200006528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d",nocase; classtype:attempted-recon; sid:200006529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/",nocase; classtype:attempted-recon; sid:200006530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wellingtoncloud-my.sharepoint.com",nocase; http_uri; content:"/personal/lynne_barron_eaglehouseschool_com/_layouts/15/wopiframe.aspx?guestaccesstoken=5r%2fl6nh%2bt0nfkb7xwynvz8n1wumz0wz%2fpwkgri5p6%2fs%3d&docid=1_192cb7c38faeb476cb58ce8f71598361c&wdformid=%7b3e42bd82%2db59e%2d403b%2d9998%2d0c2dd21bd5e6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withkoji.com",nocase; http_uri; content:"/@bt_home",nocase; classtype:attempted-recon; sid:200006532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withkoji.com",nocase; http_uri; content:"/@coxupdate78",nocase; classtype:attempted-recon; sid:200006533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wm88bet.com",nocase; http_uri; content:"/f6.php",nocase; classtype:attempted-recon; sid:200006534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp.adufes.org.br",nocase; http_uri; content:"/wp-includes/js/thickbox/fusks3/f4f4/f434/g4543f5/weewee/xwewdw/ibanking-standard-bank-rd719",nocase; classtype:attempted-recon; sid:200006535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp.adufes.org.br",nocase; http_uri; content:"/wp-includes/js/thickbox/fusks3/f4f4/f434/g4543f5/weewee/xwewdw/ibanking-standard-bank-rd719/",nocase; classtype:attempted-recon; sid:200006536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvk12-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pklewis_k12_wv_us/_layouts/15/wopiframe.aspx?guestaccesstoken=tqintdtuii%2bam%2fbqmtnjkenggs2dptoi8hs2jqftjkq%3d&docid=1_1446052cffa4c4871bd24bb98fe86ed6d&wdformid=%7bdf30d25d%2d0b59%2d47e5%2d956e%2dc601397ea4d7%7d&action=formsubmit&cid=57cdb8ab-426b-4eff-a51f-903ee3684f96",nocase; classtype:attempted-recon; sid:200006537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvk12-my.sharepoint.com",nocase; http_uri; content:"/personal/pklewis_k12_wv_us/_layouts/15/wopiframe.aspx?guestaccesstoken=tqintdtuii%2bam%2fbqmtnjkenggs2dptoi8hs2jqftjkq%3d&docid=1_1446052cffa4c4871bd24bb98fe86ed6d&wdformid=%7bdf30d25d%2d0b59%2d47e5%2d956e%2dc601397ea4d7%7d&action=formsubmit&cid=57cdb8ab-426b-4eff-a51f-903ee3684f96",nocase; classtype:attempted-recon; sid:200006538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com",nocase; classtype:attempted-recon; sid:200006539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com2.",nocase; classtype:attempted-recon; sid:200006540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=organization",nocase; classtype:attempted-recon; sid:200006541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xurl.es",nocase; http_uri; content:"/l0f93",nocase; classtype:attempted-recon; sid:200006542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yarwoodfineart.com",nocase; http_uri; content:"/chpost/ch/",nocase; classtype:attempted-recon; sid:200006543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yastatic.net",nocase; http_uri; content:"/awaps-ad-sdk-js-bundles/1.0-3871/bundles-es2017/inpage.bundle.js",nocase; classtype:attempted-recon; sid:200006544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yourbudgit.com",nocase; http_uri; content:"/wp-content/wellsfargo/auth/signin",nocase; classtype:attempted-recon; sid:200006545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youtube.com",nocase; http_uri; content:"/redirect?event=video_description&amp\;redir_token=quffluhqazjnrtryamdoudhsmxhgbfzqvnm4ymrczlk5d3xbq3jtc0trauh6afm2v2zrzjzzwvdwlxqxwtvntvjkx19olvbmbkg2whdradbnmlzon2jxoudezdjium5hqtnpav9qsgtfufjizeltb0jgr1ddr0d0vk5qsurlmewtrvfnnmg2n28xswlcujzla2t4bfloewzsaw&amp\;q=https%3a%2f%2fbit.ly%2f2qq1myh",nocase; classtype:attempted-recon; sid:200006546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/2s45v2",nocase; classtype:attempted-recon; sid:200006547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/kms8u47zlxwk",nocase; classtype:attempted-recon; sid:200006548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/nckeqquhrpuf",nocase; classtype:attempted-recon; sid:200006549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#%0%",nocase; classtype:attempted-recon; sid:200006550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#clarencecalhoun@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#jaygallagher@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#omflavin@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200006554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rb7bg#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/twq3f",nocase; classtype:attempted-recon; sid:200006556; rev:1;)
Reference in New Issue View Git Blame Copy Permalink