From 2ed0ce9ce9b34b7d0f6d03aae420f89bbe3503c5 Mon Sep 17 00:00:00 2001 From: curben-bot <3048979-curben-bot@users.noreply.gitlab.com> Date: Tue, 6 Apr 2021 12:08:25 +0000 Subject: [PATCH] Filter updated: Tue, 06 Apr 2021 12:08:25 UTC --- dist/pup-filter-ag.txt | 18 +- dist/pup-filter-agh.txt | 18 +- dist/pup-filter-bind.conf | 18 +- dist/pup-filter-dnsmasq.conf | 18 +- dist/pup-filter-domains.txt | 18 +- dist/pup-filter-hosts.txt | 18 +- dist/pup-filter-rpz.conf | 20 +- dist/pup-filter-snort2.rules | 954 +++++++++++++++++---------------- dist/pup-filter-snort3.rules | 954 +++++++++++++++++---------------- dist/pup-filter-suricata.rules | 954 +++++++++++++++++---------------- dist/pup-filter-unbound.conf | 18 +- dist/pup-filter-vivaldi.txt | 18 +- dist/pup-filter.tpl | 18 +- dist/pup-filter.txt | 18 +- 14 files changed, 1601 insertions(+), 1461 deletions(-) diff --git a/dist/pup-filter-ag.txt b/dist/pup-filter-ag.txt index 7e0f874..ad73a78 100644 --- a/dist/pup-filter-ag.txt +++ b/dist/pup-filter-ag.txt @@ -1,6 +1,6 @@ ! Title: PUP Domains Blocklist (AdGuard) ! Description: Block domains that host potentially unwanted programs (PUP) -! Updated: Tue, 06 Apr 2021 00:07:15 UTC +! Updated: Tue, 06 Apr 2021 12:08:24 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/pup-filter ! License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ ||123news.website$all ||20patogh.com$all ||321movies.xyz$all -||4uabs.club$all ||7awwa2.xyz$all +||abcscience.xyz$all ||abeah-security.xyz$all ||adrondespi.top$all ||advancecare.info$all ||akb48wrapup.com$all ||amateurxporn.com$all +||animenation.org$all ||apptool.me$all ||ashtdi.cn$all ||assuredhealth.info$all @@ -37,10 +38,10 @@ ||bodyamaze.club$all ||bodyselfcare.info$all ||browsercheck.site$all +||btcinvesting.info$all ||bulley.shop$all ||cabins-r-us.com$all ||calculateprint.xyz$all -||care-connection.info$all ||carebility.info$all ||carevision.info$all ||celebseven.com$all @@ -81,6 +82,7 @@ ||filmrod.xyz$all ||films-down.com$all ||financial-deals.xyz$all +||findforus.net$all ||findoffers.co$all ||findperfectplaces4download.work$all ||findyourultimateplayersfirst.best$all @@ -132,11 +134,13 @@ ||gramp.xyz$all ||grandcasinoprize.info$all ||greatplaceofstubs.work$all +||greatsearch.xyz$all ||growthnetic.club$all ||hailso.xyz$all ||haircarepro.info$all ||happyactive.today$all ||happymakeworld.xyz$all +||healandgrow.club$all ||healthdefine.info$all ||healthdome.info$all ||healtheezy.info$all @@ -223,6 +227,7 @@ ||meeryslotspin.xyz$all ||merryplayglobal.xyz$all ||merryplayworld.xyz$all +||mindbank.ai$all ||mindmatch.ai$all ||mistraffic.me$all ||modern-security.xyz$all @@ -233,6 +238,7 @@ ||nosyknot.xyz$all ||nutrinamic.info$all ||onegowc.pw$all +||onlinecinema.eu$all ||operatecompletely-theprecisefile.best$all ||operatecompletely-thespeedyfile.best$all ||operateextremely-theprogressivefile.best$all @@ -289,6 +295,7 @@ ||performuber-theoriginalfile.best$all ||performuber-therenewedfile.best$all ||piorkeepi.top$all +||placesiteb.xyz$all ||placesitee.xyz$all ||placewebe.xyz$all ||plampo.xyz$all @@ -299,6 +306,7 @@ ||preparedforsafeupgrading.work$all ||primawise.info$all ||primecare.today$all +||productiq.net$all ||prohealthroutine.info$all ||protect-connection.com$all ||protectyourvpn.com$all @@ -406,6 +414,7 @@ ||syncrenewed-bestcompletelyfile.best$all ||syncuber-bestoriginalfile.best$all ||syncuber-bestprecisefile.best$all +||tackis.xyz$all ||talskingest.top$all ||tastefulwood.xyz$all ||theable.me$all @@ -422,10 +431,10 @@ ||thehealthystyle.info$all ||thehealthyvibe.info$all ||thehotshot.info$all -||thelastpicture.show$all ||thenewjourney.info$all ||thepackage.club$all ||thesafestplayerlinks.work$all +||theslotomania.info$all ||thestablealwayssafeupdates.work$all ||thestablegreatupdates.work$all ||thestablegreatupgrades.best$all @@ -460,6 +469,7 @@ ||website4all.info$all ||websiteforall.work$all ||websitetoget.work$all +||webtip.co$all ||wellnessgram.info$all ||wellnessplum.info$all ||wherentlybrane.site$all diff --git a/dist/pup-filter-agh.txt b/dist/pup-filter-agh.txt index afd709c..0bbbb08 100644 --- a/dist/pup-filter-agh.txt +++ b/dist/pup-filter-agh.txt @@ -1,6 +1,6 @@ ! Title: PUP Domains Blocklist (AdGuard Home) ! Description: Block domains that host potentially unwanted programs (PUP) -! Updated: Tue, 06 Apr 2021 00:07:15 UTC +! Updated: Tue, 06 Apr 2021 12:08:24 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/pup-filter ! License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ ||123news.website^ ||20patogh.com^ ||321movies.xyz^ -||4uabs.club^ ||7awwa2.xyz^ +||abcscience.xyz^ ||abeah-security.xyz^ ||adrondespi.top^ ||advancecare.info^ ||akb48wrapup.com^ ||amateurxporn.com^ +||animenation.org^ ||apptool.me^ ||ashtdi.cn^ ||assuredhealth.info^ @@ -37,10 +38,10 @@ ||bodyamaze.club^ ||bodyselfcare.info^ ||browsercheck.site^ +||btcinvesting.info^ ||bulley.shop^ ||cabins-r-us.com^ ||calculateprint.xyz^ -||care-connection.info^ ||carebility.info^ ||carevision.info^ ||celebseven.com^ @@ -81,6 +82,7 @@ ||filmrod.xyz^ ||films-down.com^ ||financial-deals.xyz^ +||findforus.net^ ||findoffers.co^ ||findperfectplaces4download.work^ ||findyourultimateplayersfirst.best^ @@ -132,11 +134,13 @@ ||gramp.xyz^ ||grandcasinoprize.info^ ||greatplaceofstubs.work^ +||greatsearch.xyz^ ||growthnetic.club^ ||hailso.xyz^ ||haircarepro.info^ ||happyactive.today^ ||happymakeworld.xyz^ +||healandgrow.club^ ||healthdefine.info^ ||healthdome.info^ ||healtheezy.info^ @@ -223,6 +227,7 @@ ||meeryslotspin.xyz^ ||merryplayglobal.xyz^ ||merryplayworld.xyz^ +||mindbank.ai^ ||mindmatch.ai^ ||mistraffic.me^ ||modern-security.xyz^ @@ -233,6 +238,7 @@ ||nosyknot.xyz^ ||nutrinamic.info^ ||onegowc.pw^ +||onlinecinema.eu^ ||operatecompletely-theprecisefile.best^ ||operatecompletely-thespeedyfile.best^ ||operateextremely-theprogressivefile.best^ @@ -289,6 +295,7 @@ ||performuber-theoriginalfile.best^ ||performuber-therenewedfile.best^ ||piorkeepi.top^ +||placesiteb.xyz^ ||placesitee.xyz^ ||placewebe.xyz^ ||plampo.xyz^ @@ -299,6 +306,7 @@ ||preparedforsafeupgrading.work^ ||primawise.info^ ||primecare.today^ +||productiq.net^ ||prohealthroutine.info^ ||protect-connection.com^ ||protectyourvpn.com^ @@ -406,6 +414,7 @@ ||syncrenewed-bestcompletelyfile.best^ ||syncuber-bestoriginalfile.best^ ||syncuber-bestprecisefile.best^ +||tackis.xyz^ ||talskingest.top^ ||tastefulwood.xyz^ ||theable.me^ @@ -422,10 +431,10 @@ ||thehealthystyle.info^ ||thehealthyvibe.info^ ||thehotshot.info^ -||thelastpicture.show^ ||thenewjourney.info^ ||thepackage.club^ ||thesafestplayerlinks.work^ +||theslotomania.info^ ||thestablealwayssafeupdates.work^ ||thestablegreatupdates.work^ ||thestablegreatupgrades.best^ @@ -460,6 +469,7 @@ ||website4all.info^ ||websiteforall.work^ ||websitetoget.work^ +||webtip.co^ ||wellnessgram.info^ ||wellnessplum.info^ ||wherentlybrane.site^ diff --git a/dist/pup-filter-bind.conf b/dist/pup-filter-bind.conf index 1467faa..9d7f87e 100644 --- a/dist/pup-filter-bind.conf +++ b/dist/pup-filter-bind.conf @@ -1,6 +1,6 @@ # Title: PUP Domains BIND Blocklist # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ zone "123news.website" { type master; notify no; file "null.zone.file"; }; zone "20patogh.com" { type master; notify no; file "null.zone.file"; }; zone "321movies.xyz" { type master; notify no; file "null.zone.file"; }; -zone "4uabs.club" { type master; notify no; file "null.zone.file"; }; zone "7awwa2.xyz" { type master; notify no; file "null.zone.file"; }; +zone "abcscience.xyz" { type master; notify no; file "null.zone.file"; }; zone "abeah-security.xyz" { type master; notify no; file "null.zone.file"; }; zone "adrondespi.top" { type master; notify no; file "null.zone.file"; }; zone "advancecare.info" { type master; notify no; file "null.zone.file"; }; zone "akb48wrapup.com" { type master; notify no; file "null.zone.file"; }; zone "amateurxporn.com" { type master; notify no; file "null.zone.file"; }; +zone "animenation.org" { type master; notify no; file "null.zone.file"; }; zone "apptool.me" { type master; notify no; file "null.zone.file"; }; zone "ashtdi.cn" { type master; notify no; file "null.zone.file"; }; zone "assuredhealth.info" { type master; notify no; file "null.zone.file"; }; @@ -37,10 +38,10 @@ zone "biztherapy.info" { type master; notify no; file "null.zone.file"; }; zone "bodyamaze.club" { type master; notify no; file "null.zone.file"; }; zone "bodyselfcare.info" { type master; notify no; file "null.zone.file"; }; zone "browsercheck.site" { type master; notify no; file "null.zone.file"; }; +zone "btcinvesting.info" { type master; notify no; file "null.zone.file"; }; zone "bulley.shop" { type master; notify no; file "null.zone.file"; }; zone "cabins-r-us.com" { type master; notify no; file "null.zone.file"; }; zone "calculateprint.xyz" { type master; notify no; file "null.zone.file"; }; -zone "care-connection.info" { type master; notify no; file "null.zone.file"; }; zone "carebility.info" { type master; notify no; file "null.zone.file"; }; zone "carevision.info" { type master; notify no; file "null.zone.file"; }; zone "celebseven.com" { type master; notify no; file "null.zone.file"; }; @@ -81,6 +82,7 @@ zone "filmesonlineturbo.net" { type master; notify no; file "null.zone.file"; }; zone "filmrod.xyz" { type master; notify no; file "null.zone.file"; }; zone "films-down.com" { type master; notify no; file "null.zone.file"; }; zone "financial-deals.xyz" { type master; notify no; file "null.zone.file"; }; +zone "findforus.net" { type master; notify no; file "null.zone.file"; }; zone "findoffers.co" { type master; notify no; file "null.zone.file"; }; zone "findperfectplaces4download.work" { type master; notify no; file "null.zone.file"; }; zone "findyourultimateplayersfirst.best" { type master; notify no; file "null.zone.file"; }; @@ -132,11 +134,13 @@ zone "graburprize.net" { type master; notify no; file "null.zone.file"; }; zone "gramp.xyz" { type master; notify no; file "null.zone.file"; }; zone "grandcasinoprize.info" { type master; notify no; file "null.zone.file"; }; zone "greatplaceofstubs.work" { type master; notify no; file "null.zone.file"; }; +zone "greatsearch.xyz" { type master; notify no; file "null.zone.file"; }; zone "growthnetic.club" { type master; notify no; file "null.zone.file"; }; zone "hailso.xyz" { type master; notify no; file "null.zone.file"; }; zone "haircarepro.info" { type master; notify no; file "null.zone.file"; }; zone "happyactive.today" { type master; notify no; file "null.zone.file"; }; zone "happymakeworld.xyz" { type master; notify no; file "null.zone.file"; }; +zone "healandgrow.club" { type master; notify no; file "null.zone.file"; }; zone "healthdefine.info" { type master; notify no; file "null.zone.file"; }; zone "healthdome.info" { type master; notify no; file "null.zone.file"; }; zone "healtheezy.info" { type master; notify no; file "null.zone.file"; }; @@ -223,6 +227,7 @@ zone "medsjournal.info" { type master; notify no; file "null.zone.file"; }; zone "meeryslotspin.xyz" { type master; notify no; file "null.zone.file"; }; zone "merryplayglobal.xyz" { type master; notify no; file "null.zone.file"; }; zone "merryplayworld.xyz" { type master; notify no; file "null.zone.file"; }; +zone "mindbank.ai" { type master; notify no; file "null.zone.file"; }; zone "mindmatch.ai" { type master; notify no; file "null.zone.file"; }; zone "mistraffic.me" { type master; notify no; file "null.zone.file"; }; zone "modern-security.xyz" { type master; notify no; file "null.zone.file"; }; @@ -233,6 +238,7 @@ zone "nogfw.pro" { type master; notify no; file "null.zone.file"; }; zone "nosyknot.xyz" { type master; notify no; file "null.zone.file"; }; zone "nutrinamic.info" { type master; notify no; file "null.zone.file"; }; zone "onegowc.pw" { type master; notify no; file "null.zone.file"; }; +zone "onlinecinema.eu" { type master; notify no; file "null.zone.file"; }; zone "operatecompletely-theprecisefile.best" { type master; notify no; file "null.zone.file"; }; zone "operatecompletely-thespeedyfile.best" { type master; notify no; file "null.zone.file"; }; zone "operateextremely-theprogressivefile.best" { type master; notify no; file "null.zone.file"; }; @@ -289,6 +295,7 @@ zone "performspeedy-thegreatlyfile.best" { type master; notify no; file "null.zo zone "performuber-theoriginalfile.best" { type master; notify no; file "null.zone.file"; }; zone "performuber-therenewedfile.best" { type master; notify no; file "null.zone.file"; }; zone "piorkeepi.top" { type master; notify no; file "null.zone.file"; }; +zone "placesiteb.xyz" { type master; notify no; file "null.zone.file"; }; zone "placesitee.xyz" { type master; notify no; file "null.zone.file"; }; zone "placewebe.xyz" { type master; notify no; file "null.zone.file"; }; zone "plampo.xyz" { type master; notify no; file "null.zone.file"; }; @@ -299,6 +306,7 @@ zone "premiernursingacademy.org" { type master; notify no; file "null.zone.file" zone "preparedforsafeupgrading.work" { type master; notify no; file "null.zone.file"; }; zone "primawise.info" { type master; notify no; file "null.zone.file"; }; zone "primecare.today" { type master; notify no; file "null.zone.file"; }; +zone "productiq.net" { type master; notify no; file "null.zone.file"; }; zone "prohealthroutine.info" { type master; notify no; file "null.zone.file"; }; zone "protect-connection.com" { type master; notify no; file "null.zone.file"; }; zone "protectyourvpn.com" { type master; notify no; file "null.zone.file"; }; @@ -406,6 +414,7 @@ zone "syncprogressive-besthighlyfile.best" { type master; notify no; file "null. zone "syncrenewed-bestcompletelyfile.best" { type master; notify no; file "null.zone.file"; }; zone "syncuber-bestoriginalfile.best" { type master; notify no; file "null.zone.file"; }; zone "syncuber-bestprecisefile.best" { type master; notify no; file "null.zone.file"; }; +zone "tackis.xyz" { type master; notify no; file "null.zone.file"; }; zone "talskingest.top" { type master; notify no; file "null.zone.file"; }; zone "tastefulwood.xyz" { type master; notify no; file "null.zone.file"; }; zone "theable.me" { type master; notify no; file "null.zone.file"; }; @@ -422,10 +431,10 @@ zone "thehealthpedia.info" { type master; notify no; file "null.zone.file"; }; zone "thehealthystyle.info" { type master; notify no; file "null.zone.file"; }; zone "thehealthyvibe.info" { type master; notify no; file "null.zone.file"; }; zone "thehotshot.info" { type master; notify no; file "null.zone.file"; }; -zone "thelastpicture.show" { type master; notify no; file "null.zone.file"; }; zone "thenewjourney.info" { type master; notify no; file "null.zone.file"; }; zone "thepackage.club" { type master; notify no; file "null.zone.file"; }; zone "thesafestplayerlinks.work" { type master; notify no; file "null.zone.file"; }; +zone "theslotomania.info" { type master; notify no; file "null.zone.file"; }; zone "thestablealwayssafeupdates.work" { type master; notify no; file "null.zone.file"; }; zone "thestablegreatupdates.work" { type master; notify no; file "null.zone.file"; }; zone "thestablegreatupgrades.best" { type master; notify no; file "null.zone.file"; }; @@ -460,6 +469,7 @@ zone "vpntool.me" { type master; notify no; file "null.zone.file"; }; zone "website4all.info" { type master; notify no; file "null.zone.file"; }; zone "websiteforall.work" { type master; notify no; file "null.zone.file"; }; zone "websitetoget.work" { type master; notify no; file "null.zone.file"; }; +zone "webtip.co" { type master; notify no; file "null.zone.file"; }; zone "wellnessgram.info" { type master; notify no; file "null.zone.file"; }; zone "wellnessplum.info" { type master; notify no; file "null.zone.file"; }; zone "wherentlybrane.site" { type master; notify no; file "null.zone.file"; }; diff --git a/dist/pup-filter-dnsmasq.conf b/dist/pup-filter-dnsmasq.conf index ed82597..9c578b9 100644 --- a/dist/pup-filter-dnsmasq.conf +++ b/dist/pup-filter-dnsmasq.conf @@ -1,6 +1,6 @@ # Title: PUP Domains dnsmasq Blocklist # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ address=/123news.website/0.0.0.0 address=/20patogh.com/0.0.0.0 address=/321movies.xyz/0.0.0.0 -address=/4uabs.club/0.0.0.0 address=/7awwa2.xyz/0.0.0.0 +address=/abcscience.xyz/0.0.0.0 address=/abeah-security.xyz/0.0.0.0 address=/adrondespi.top/0.0.0.0 address=/advancecare.info/0.0.0.0 address=/akb48wrapup.com/0.0.0.0 address=/amateurxporn.com/0.0.0.0 +address=/animenation.org/0.0.0.0 address=/apptool.me/0.0.0.0 address=/ashtdi.cn/0.0.0.0 address=/assuredhealth.info/0.0.0.0 @@ -37,10 +38,10 @@ address=/biztherapy.info/0.0.0.0 address=/bodyamaze.club/0.0.0.0 address=/bodyselfcare.info/0.0.0.0 address=/browsercheck.site/0.0.0.0 +address=/btcinvesting.info/0.0.0.0 address=/bulley.shop/0.0.0.0 address=/cabins-r-us.com/0.0.0.0 address=/calculateprint.xyz/0.0.0.0 -address=/care-connection.info/0.0.0.0 address=/carebility.info/0.0.0.0 address=/carevision.info/0.0.0.0 address=/celebseven.com/0.0.0.0 @@ -81,6 +82,7 @@ address=/filmesonlineturbo.net/0.0.0.0 address=/filmrod.xyz/0.0.0.0 address=/films-down.com/0.0.0.0 address=/financial-deals.xyz/0.0.0.0 +address=/findforus.net/0.0.0.0 address=/findoffers.co/0.0.0.0 address=/findperfectplaces4download.work/0.0.0.0 address=/findyourultimateplayersfirst.best/0.0.0.0 @@ -132,11 +134,13 @@ address=/graburprize.net/0.0.0.0 address=/gramp.xyz/0.0.0.0 address=/grandcasinoprize.info/0.0.0.0 address=/greatplaceofstubs.work/0.0.0.0 +address=/greatsearch.xyz/0.0.0.0 address=/growthnetic.club/0.0.0.0 address=/hailso.xyz/0.0.0.0 address=/haircarepro.info/0.0.0.0 address=/happyactive.today/0.0.0.0 address=/happymakeworld.xyz/0.0.0.0 +address=/healandgrow.club/0.0.0.0 address=/healthdefine.info/0.0.0.0 address=/healthdome.info/0.0.0.0 address=/healtheezy.info/0.0.0.0 @@ -223,6 +227,7 @@ address=/medsjournal.info/0.0.0.0 address=/meeryslotspin.xyz/0.0.0.0 address=/merryplayglobal.xyz/0.0.0.0 address=/merryplayworld.xyz/0.0.0.0 +address=/mindbank.ai/0.0.0.0 address=/mindmatch.ai/0.0.0.0 address=/mistraffic.me/0.0.0.0 address=/modern-security.xyz/0.0.0.0 @@ -233,6 +238,7 @@ address=/nogfw.pro/0.0.0.0 address=/nosyknot.xyz/0.0.0.0 address=/nutrinamic.info/0.0.0.0 address=/onegowc.pw/0.0.0.0 +address=/onlinecinema.eu/0.0.0.0 address=/operatecompletely-theprecisefile.best/0.0.0.0 address=/operatecompletely-thespeedyfile.best/0.0.0.0 address=/operateextremely-theprogressivefile.best/0.0.0.0 @@ -289,6 +295,7 @@ address=/performspeedy-thegreatlyfile.best/0.0.0.0 address=/performuber-theoriginalfile.best/0.0.0.0 address=/performuber-therenewedfile.best/0.0.0.0 address=/piorkeepi.top/0.0.0.0 +address=/placesiteb.xyz/0.0.0.0 address=/placesitee.xyz/0.0.0.0 address=/placewebe.xyz/0.0.0.0 address=/plampo.xyz/0.0.0.0 @@ -299,6 +306,7 @@ address=/premiernursingacademy.org/0.0.0.0 address=/preparedforsafeupgrading.work/0.0.0.0 address=/primawise.info/0.0.0.0 address=/primecare.today/0.0.0.0 +address=/productiq.net/0.0.0.0 address=/prohealthroutine.info/0.0.0.0 address=/protect-connection.com/0.0.0.0 address=/protectyourvpn.com/0.0.0.0 @@ -406,6 +414,7 @@ address=/syncprogressive-besthighlyfile.best/0.0.0.0 address=/syncrenewed-bestcompletelyfile.best/0.0.0.0 address=/syncuber-bestoriginalfile.best/0.0.0.0 address=/syncuber-bestprecisefile.best/0.0.0.0 +address=/tackis.xyz/0.0.0.0 address=/talskingest.top/0.0.0.0 address=/tastefulwood.xyz/0.0.0.0 address=/theable.me/0.0.0.0 @@ -422,10 +431,10 @@ address=/thehealthpedia.info/0.0.0.0 address=/thehealthystyle.info/0.0.0.0 address=/thehealthyvibe.info/0.0.0.0 address=/thehotshot.info/0.0.0.0 -address=/thelastpicture.show/0.0.0.0 address=/thenewjourney.info/0.0.0.0 address=/thepackage.club/0.0.0.0 address=/thesafestplayerlinks.work/0.0.0.0 +address=/theslotomania.info/0.0.0.0 address=/thestablealwayssafeupdates.work/0.0.0.0 address=/thestablegreatupdates.work/0.0.0.0 address=/thestablegreatupgrades.best/0.0.0.0 @@ -460,6 +469,7 @@ address=/vpntool.me/0.0.0.0 address=/website4all.info/0.0.0.0 address=/websiteforall.work/0.0.0.0 address=/websitetoget.work/0.0.0.0 +address=/webtip.co/0.0.0.0 address=/wellnessgram.info/0.0.0.0 address=/wellnessplum.info/0.0.0.0 address=/wherentlybrane.site/0.0.0.0 diff --git a/dist/pup-filter-domains.txt b/dist/pup-filter-domains.txt index c592a24..c63e029 100644 --- a/dist/pup-filter-domains.txt +++ b/dist/pup-filter-domains.txt @@ -1,6 +1,6 @@ # Title: PUP Domains Blocklist # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ 123news.website 20patogh.com 321movies.xyz -4uabs.club 7awwa2.xyz +abcscience.xyz abeah-security.xyz adrondespi.top advancecare.info akb48wrapup.com amateurxporn.com +animenation.org apptool.me ashtdi.cn assuredhealth.info @@ -37,10 +38,10 @@ biztherapy.info bodyamaze.club bodyselfcare.info browsercheck.site +btcinvesting.info bulley.shop cabins-r-us.com calculateprint.xyz -care-connection.info carebility.info carevision.info celebseven.com @@ -81,6 +82,7 @@ filmesonlineturbo.net filmrod.xyz films-down.com financial-deals.xyz +findforus.net findoffers.co findperfectplaces4download.work findyourultimateplayersfirst.best @@ -132,11 +134,13 @@ graburprize.net gramp.xyz grandcasinoprize.info greatplaceofstubs.work +greatsearch.xyz growthnetic.club hailso.xyz haircarepro.info happyactive.today happymakeworld.xyz +healandgrow.club healthdefine.info healthdome.info healtheezy.info @@ -223,6 +227,7 @@ medsjournal.info meeryslotspin.xyz merryplayglobal.xyz merryplayworld.xyz +mindbank.ai mindmatch.ai mistraffic.me modern-security.xyz @@ -233,6 +238,7 @@ nogfw.pro nosyknot.xyz nutrinamic.info onegowc.pw +onlinecinema.eu operatecompletely-theprecisefile.best operatecompletely-thespeedyfile.best operateextremely-theprogressivefile.best @@ -289,6 +295,7 @@ performspeedy-thegreatlyfile.best performuber-theoriginalfile.best performuber-therenewedfile.best piorkeepi.top +placesiteb.xyz placesitee.xyz placewebe.xyz plampo.xyz @@ -299,6 +306,7 @@ premiernursingacademy.org preparedforsafeupgrading.work primawise.info primecare.today +productiq.net prohealthroutine.info protect-connection.com protectyourvpn.com @@ -406,6 +414,7 @@ syncprogressive-besthighlyfile.best syncrenewed-bestcompletelyfile.best syncuber-bestoriginalfile.best syncuber-bestprecisefile.best +tackis.xyz talskingest.top tastefulwood.xyz theable.me @@ -422,10 +431,10 @@ thehealthpedia.info thehealthystyle.info thehealthyvibe.info thehotshot.info -thelastpicture.show thenewjourney.info thepackage.club thesafestplayerlinks.work +theslotomania.info thestablealwayssafeupdates.work thestablegreatupdates.work thestablegreatupgrades.best @@ -460,6 +469,7 @@ vpntool.me website4all.info websiteforall.work websitetoget.work +webtip.co wellnessgram.info wellnessplum.info wherentlybrane.site diff --git a/dist/pup-filter-hosts.txt b/dist/pup-filter-hosts.txt index dd5a0cf..04d55a7 100644 --- a/dist/pup-filter-hosts.txt +++ b/dist/pup-filter-hosts.txt @@ -1,6 +1,6 @@ # Title: PUP Hosts Blocklist # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ 0.0.0.0 123news.website 0.0.0.0 20patogh.com 0.0.0.0 321movies.xyz -0.0.0.0 4uabs.club 0.0.0.0 7awwa2.xyz +0.0.0.0 abcscience.xyz 0.0.0.0 abeah-security.xyz 0.0.0.0 adrondespi.top 0.0.0.0 advancecare.info 0.0.0.0 akb48wrapup.com 0.0.0.0 amateurxporn.com +0.0.0.0 animenation.org 0.0.0.0 apptool.me 0.0.0.0 ashtdi.cn 0.0.0.0 assuredhealth.info @@ -37,10 +38,10 @@ 0.0.0.0 bodyamaze.club 0.0.0.0 bodyselfcare.info 0.0.0.0 browsercheck.site +0.0.0.0 btcinvesting.info 0.0.0.0 bulley.shop 0.0.0.0 cabins-r-us.com 0.0.0.0 calculateprint.xyz -0.0.0.0 care-connection.info 0.0.0.0 carebility.info 0.0.0.0 carevision.info 0.0.0.0 celebseven.com @@ -81,6 +82,7 @@ 0.0.0.0 filmrod.xyz 0.0.0.0 films-down.com 0.0.0.0 financial-deals.xyz +0.0.0.0 findforus.net 0.0.0.0 findoffers.co 0.0.0.0 findperfectplaces4download.work 0.0.0.0 findyourultimateplayersfirst.best @@ -132,11 +134,13 @@ 0.0.0.0 gramp.xyz 0.0.0.0 grandcasinoprize.info 0.0.0.0 greatplaceofstubs.work +0.0.0.0 greatsearch.xyz 0.0.0.0 growthnetic.club 0.0.0.0 hailso.xyz 0.0.0.0 haircarepro.info 0.0.0.0 happyactive.today 0.0.0.0 happymakeworld.xyz +0.0.0.0 healandgrow.club 0.0.0.0 healthdefine.info 0.0.0.0 healthdome.info 0.0.0.0 healtheezy.info @@ -223,6 +227,7 @@ 0.0.0.0 meeryslotspin.xyz 0.0.0.0 merryplayglobal.xyz 0.0.0.0 merryplayworld.xyz +0.0.0.0 mindbank.ai 0.0.0.0 mindmatch.ai 0.0.0.0 mistraffic.me 0.0.0.0 modern-security.xyz @@ -233,6 +238,7 @@ 0.0.0.0 nosyknot.xyz 0.0.0.0 nutrinamic.info 0.0.0.0 onegowc.pw +0.0.0.0 onlinecinema.eu 0.0.0.0 operatecompletely-theprecisefile.best 0.0.0.0 operatecompletely-thespeedyfile.best 0.0.0.0 operateextremely-theprogressivefile.best @@ -289,6 +295,7 @@ 0.0.0.0 performuber-theoriginalfile.best 0.0.0.0 performuber-therenewedfile.best 0.0.0.0 piorkeepi.top +0.0.0.0 placesiteb.xyz 0.0.0.0 placesitee.xyz 0.0.0.0 placewebe.xyz 0.0.0.0 plampo.xyz @@ -299,6 +306,7 @@ 0.0.0.0 preparedforsafeupgrading.work 0.0.0.0 primawise.info 0.0.0.0 primecare.today +0.0.0.0 productiq.net 0.0.0.0 prohealthroutine.info 0.0.0.0 protect-connection.com 0.0.0.0 protectyourvpn.com @@ -406,6 +414,7 @@ 0.0.0.0 syncrenewed-bestcompletelyfile.best 0.0.0.0 syncuber-bestoriginalfile.best 0.0.0.0 syncuber-bestprecisefile.best +0.0.0.0 tackis.xyz 0.0.0.0 talskingest.top 0.0.0.0 tastefulwood.xyz 0.0.0.0 theable.me @@ -422,10 +431,10 @@ 0.0.0.0 thehealthystyle.info 0.0.0.0 thehealthyvibe.info 0.0.0.0 thehotshot.info -0.0.0.0 thelastpicture.show 0.0.0.0 thenewjourney.info 0.0.0.0 thepackage.club 0.0.0.0 thesafestplayerlinks.work +0.0.0.0 theslotomania.info 0.0.0.0 thestablealwayssafeupdates.work 0.0.0.0 thestablegreatupdates.work 0.0.0.0 thestablegreatupgrades.best @@ -460,6 +469,7 @@ 0.0.0.0 website4all.info 0.0.0.0 websiteforall.work 0.0.0.0 websitetoget.work +0.0.0.0 webtip.co 0.0.0.0 wellnessgram.info 0.0.0.0 wellnessplum.info 0.0.0.0 wherentlybrane.site diff --git a/dist/pup-filter-rpz.conf b/dist/pup-filter-rpz.conf index 470feb6..4d067c8 100644 --- a/dist/pup-filter-rpz.conf +++ b/dist/pup-filter-rpz.conf @@ -1,25 +1,26 @@ ; Title: PUP Domains RPZ Blocklist ; Description: Block domains that host potentially unwanted programs (PUP) -; Updated: Tue, 06 Apr 2021 00:07:15 UTC +; Updated: Tue, 06 Apr 2021 12:08:24 UTC ; Expires: 1 day (update frequency) ; Homepage: https://gitlab.com/curben/pup-filter ; License: https://gitlab.com/curben/pup-filter#license ; Source: https://github.com/zhouhanc/malware-discoverer $TTL 30 -@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617667635 86400 3600 604800 30 +@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617710904 86400 3600 604800 30 NS localhost. 123news.website CNAME . 20patogh.com CNAME . 321movies.xyz CNAME . -4uabs.club CNAME . 7awwa2.xyz CNAME . +abcscience.xyz CNAME . abeah-security.xyz CNAME . adrondespi.top CNAME . advancecare.info CNAME . akb48wrapup.com CNAME . amateurxporn.com CNAME . +animenation.org CNAME . apptool.me CNAME . ashtdi.cn CNAME . assuredhealth.info CNAME . @@ -42,10 +43,10 @@ biztherapy.info CNAME . bodyamaze.club CNAME . bodyselfcare.info CNAME . browsercheck.site CNAME . +btcinvesting.info CNAME . bulley.shop CNAME . cabins-r-us.com CNAME . calculateprint.xyz CNAME . -care-connection.info CNAME . carebility.info CNAME . carevision.info CNAME . celebseven.com CNAME . @@ -86,6 +87,7 @@ filmesonlineturbo.net CNAME . filmrod.xyz CNAME . films-down.com CNAME . financial-deals.xyz CNAME . +findforus.net CNAME . findoffers.co CNAME . findperfectplaces4download.work CNAME . findyourultimateplayersfirst.best CNAME . @@ -137,11 +139,13 @@ graburprize.net CNAME . gramp.xyz CNAME . grandcasinoprize.info CNAME . greatplaceofstubs.work CNAME . +greatsearch.xyz CNAME . growthnetic.club CNAME . hailso.xyz CNAME . haircarepro.info CNAME . happyactive.today CNAME . happymakeworld.xyz CNAME . +healandgrow.club CNAME . healthdefine.info CNAME . healthdome.info CNAME . healtheezy.info CNAME . @@ -228,6 +232,7 @@ medsjournal.info CNAME . meeryslotspin.xyz CNAME . merryplayglobal.xyz CNAME . merryplayworld.xyz CNAME . +mindbank.ai CNAME . mindmatch.ai CNAME . mistraffic.me CNAME . modern-security.xyz CNAME . @@ -238,6 +243,7 @@ nogfw.pro CNAME . nosyknot.xyz CNAME . nutrinamic.info CNAME . onegowc.pw CNAME . +onlinecinema.eu CNAME . operatecompletely-theprecisefile.best CNAME . operatecompletely-thespeedyfile.best CNAME . operateextremely-theprogressivefile.best CNAME . @@ -294,6 +300,7 @@ performspeedy-thegreatlyfile.best CNAME . performuber-theoriginalfile.best CNAME . performuber-therenewedfile.best CNAME . piorkeepi.top CNAME . +placesiteb.xyz CNAME . placesitee.xyz CNAME . placewebe.xyz CNAME . plampo.xyz CNAME . @@ -304,6 +311,7 @@ premiernursingacademy.org CNAME . preparedforsafeupgrading.work CNAME . primawise.info CNAME . primecare.today CNAME . +productiq.net CNAME . prohealthroutine.info CNAME . protect-connection.com CNAME . protectyourvpn.com CNAME . @@ -411,6 +419,7 @@ syncprogressive-besthighlyfile.best CNAME . syncrenewed-bestcompletelyfile.best CNAME . syncuber-bestoriginalfile.best CNAME . syncuber-bestprecisefile.best CNAME . +tackis.xyz CNAME . talskingest.top CNAME . tastefulwood.xyz CNAME . theable.me CNAME . @@ -427,10 +436,10 @@ thehealthpedia.info CNAME . thehealthystyle.info CNAME . thehealthyvibe.info CNAME . thehotshot.info CNAME . -thelastpicture.show CNAME . thenewjourney.info CNAME . thepackage.club CNAME . thesafestplayerlinks.work CNAME . +theslotomania.info CNAME . thestablealwayssafeupdates.work CNAME . thestablegreatupdates.work CNAME . thestablegreatupgrades.best CNAME . @@ -465,6 +474,7 @@ vpntool.me CNAME . website4all.info CNAME . websiteforall.work CNAME . websitetoget.work CNAME . +webtip.co CNAME . wellnessgram.info CNAME . wellnessplum.info CNAME . wherentlybrane.site CNAME . diff --git a/dist/pup-filter-snort2.rules b/dist/pup-filter-snort2.rules index 513437a..bfc50a1 100644 --- a/dist/pup-filter-snort2.rules +++ b/dist/pup-filter-snort2.rules @@ -1,6 +1,6 @@ # Title: PUP Domains Snort2 Ruleset # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,479 +8,489 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"123news.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000001; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"20patogh.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000002; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"321movies.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000003; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"4uabs.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000004; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"7awwa2.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000005; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"7awwa2.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000004; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"abcscience.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000005; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"abeah-security.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000006; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"adrondespi.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000007; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"advancecare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000008; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"akb48wrapup.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000009; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"amateurxporn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000010; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"apptool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000011; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashtdi.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000012; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"assuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000013; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"asufij.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000014; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"auto-lawyer.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000015; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"baseofmp3.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000016; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000017; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000018; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000019; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestresults.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000020; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000021; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000022; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000023; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000024; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigcbd.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000025; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigdaycasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000026; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-trader.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000027; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bittrend.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000028; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"biztherapy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000029; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyamaze.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000030; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyselfcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000031; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"browsercheck.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000032; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulley.shop"; content:"Host"; http_header; classtype:web-application-activity; sid:300000033; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabins-r-us.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000034; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"calculateprint.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000035; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"care-connection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000036; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carebility.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000037; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carevision.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000038; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"celebseven.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000039; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"centrodeartigos.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000040; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheerplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000041; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"coachbelief.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000042; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"collectrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000043; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"comphp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000044; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceivecolor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000045; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conflaqpzc.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000046; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cooing.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000047; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000048; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-monitor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000049; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-resources.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000050; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotradingcourses.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000051; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptounlimited.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000052; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cs-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000053; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cselfconnect.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000054; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"curesector.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000055; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"degreenm.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000056; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"delightcmain.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000057; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalinvest.news"; content:"Host"; http_header; classtype:web-application-activity; sid:300000058; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"displayfriend.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000059; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ditvl.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000060; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonballclub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000061; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehousan.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000062; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eproute.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000063; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eroanimeittyokusen.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000064; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"erotica.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000065; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"excitingthing.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000066; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrasafe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000067; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-sex.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000068; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000069; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000070; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspotb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000071; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastwebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000072; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmesonlineturbo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000073; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmrod.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000074; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"films-down.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000075; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"financial-deals.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000076; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findoffers.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000077; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces4download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000078; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findyourultimateplayersfirst.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000079; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"firststableplayer.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000080; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisham.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000081; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000082; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandstable.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000083; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitbodyandsoul.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000084; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitcourage.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000085; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspark.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000086; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspot.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000087; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000088; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitlifevalue.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000089; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitnessdial.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000090; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000091; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flatbellylife.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000092; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"foregoingpump.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000093; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"forsalecheap.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000094; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000095; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freshclover.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000096; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuck-me-hard.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000097; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000098; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000099; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000100; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funsiteb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000101; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspinf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000102; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000103; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funwebd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000104; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsxqc.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000105; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gainhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000106; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gapingshame.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000107; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"generouscare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000108; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getstablesystemupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000109; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000110; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladdboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000111; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000112; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladslotweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000113; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000114; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotwonder.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000115; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000116; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000117; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000118; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000119; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000120; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000121; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.store"; content:"Host"; http_header; classtype:web-application-activity; sid:300000122; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"govpshosting.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000123; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"graburprize.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000124; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gramp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000125; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"grandcasinoprize.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000126; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"greatplaceofstubs.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000127; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"growthnetic.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000128; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"hailso.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000129; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"haircarepro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000130; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"happyactive.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000131; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"happymakeworld.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000132; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthdefine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000133; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthdome.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000134; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healtheezy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000135; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthemerge.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000136; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthjolly.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000137; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmainly.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000138; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmaintain.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000139; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmama.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000140; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmanic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000141; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmarlin.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000142; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthneo.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000143; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthomega.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000144; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000145; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthreportsweb.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000146; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthreward.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000147; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthroll.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000148; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthscale.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000149; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthschedule.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000150; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthspark.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000151; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthsupreme.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000152; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthtag.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000153; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthupper.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000154; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthvenue.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000155; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthvibe.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000156; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthwella.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000157; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthy-lifestyle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000158; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthyideal.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000159; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthyparker.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000160; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthysure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000161; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"idtheft-alert.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000162; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iketo.diet"; content:"Host"; http_header; classtype:web-application-activity; sid:300000163; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"inappropriate.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000164; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"information.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000165; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"instablog.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000166; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"insuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000167; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosrecommendedvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000168; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"izipik.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000169; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyplaceplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000170; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotmap.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000171; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000172; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrenthouse.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000173; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jubilantdstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000174; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"kad3md.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000175; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepithealthy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000176; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketodietrecipes.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000177; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"leeching.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000178; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000179; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000180; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000181; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplayerupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000182; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendarysiteupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000183; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000184; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000185; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000186; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"life-esteem.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000187; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifecaregoal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000188; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightstop.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000189; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livehealthcare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000190; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livelyyroad.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000191; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livingmighty.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000192; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadfree-bestheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000193; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000194; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000195; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadheavily-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000196; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loosefit.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000197; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loveorfun.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000198; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckjackcasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000199; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckymedia.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000200; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckymedia.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000201; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"madpandatv.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000202; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"majorhealthpro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000203; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"makemesafeios.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000204; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"managestrong-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000205; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000206; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000207; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000208; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-theswiftfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000209; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mathison.io"; content:"Host"; http_header; classtype:web-application-activity; sid:300000210; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"max-care.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000211; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediaplayer24.ml"; content:"Host"; http_header; classtype:web-application-activity; sid:300000212; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicomatic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000213; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medjournalketo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000214; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medsjournal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000215; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeryslotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000216; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"merryplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000217; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"merryplayworld.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000218; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mindmatch.ai"; content:"Host"; http_header; classtype:web-application-activity; sid:300000219; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mistraffic.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000220; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"modern-security.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000221; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"monitoring-credit.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000222; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"multitax.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000223; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"newsitedowloads.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000224; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nogfw.pro"; content:"Host"; http_header; classtype:web-application-activity; sid:300000225; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nosyknot.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000226; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nutrinamic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000227; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"onegowc.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000228; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatecompletely-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000229; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatecompletely-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000230; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateextremely-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000231; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateextremely-therenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000232; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatefree-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000233; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operategreatly-therefinedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000234; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operategreatly-theswiftfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000235; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatehighly-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000236; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatehighly-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000237; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateintensely-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000238; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateintensely-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000239; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatenewest-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000240; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoriginal-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000241; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoriginal-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000242; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoverly-thesophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000243; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateprecise-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000244; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateprogressive-theintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000245; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatequick-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000246; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operaterefined-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000247; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operaterenewed-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000248; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatesophisticated-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000249; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatespeedy-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000250; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateuber-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000251; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateuber-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000252; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"patriothealth.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000253; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcicompliancemanager.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000254; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectplaceonnetforplayers.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000255; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performcompletely-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000256; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performcompletely-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000257; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performextremely-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000258; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performfree-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000259; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performgreatly-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000260; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performheavily-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000261; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000262; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000263; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000264; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performintensely-thedevelopedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000265; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performlatest-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000266; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performmost-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000267; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performmost-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000268; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoriginal-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000269; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoriginal-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000270; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoverly-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000271; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprecise-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000272; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprecise-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000273; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprogressive-theintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000274; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprogressive-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000275; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performquick-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000276; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrecent-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000277; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrefined-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000278; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrenewed-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000279; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performsophisticated-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000280; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performspeedy-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000281; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performuber-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000282; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performuber-therenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000283; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"piorkeepi.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000284; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"placesitee.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000285; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"placewebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000286; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"plampo.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000287; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspina.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000288; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspind.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000289; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspote.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000290; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"premiernursingacademy.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000291; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"preparedforsafeupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000292; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primawise.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000293; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primecare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000294; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"prohealthroutine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000295; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-connection.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000296; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protectyourvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000297; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"readyhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000298; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"readyhealthgo.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000299; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000300; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000301; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000302; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000303; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000304; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000305; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000306; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliablesoftwarevideos.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000307; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"remedify.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000308; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000309; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000310; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000311; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000312; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000313; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"resignation.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000314; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"roadtoyourhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000315; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"robogarden.io"; content:"Host"; http_header; classtype:web-application-activity; sid:300000316; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rootessential.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000317; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rotharbor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000318; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runadvanced-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000319; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runcurrent-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000320; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rundeveloped-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000321; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000322; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestcurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000323; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000324; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000325; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runfree-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000326; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runintensely-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000327; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runlatest-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000328; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runnewest-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000329; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoriginal-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000330; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoriginal-bestintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000331; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestdevelopedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000332; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000333; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000334; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runrecent-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000335; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runrecent-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000336; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safelyonline.tech"; content:"Host"; http_header; classtype:web-application-activity; sid:300000337; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safest4placeupdate.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000338; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safest4placeupdates.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000339; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"scheduleagreement.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000340; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"score-monitoring.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000341; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"search-tool.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000342; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"search-trends.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000343; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"searchfeed.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000344; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-alert.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000345; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000346; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-monitoring.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000347; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"second-handjam.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000348; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-made-easy.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000349; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-pro.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000350; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-protection.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000351; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"seemlast.monster"; content:"Host"; http_header; classtype:web-application-activity; sid:300000352; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"selfradiance.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000353; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shkshk.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000354; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopnsave.world"; content:"Host"; http_header; classtype:web-application-activity; sid:300000355; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shoppingexp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000356; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartys.link"; content:"Host"; http_header; classtype:web-application-activity; sid:300000357; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000358; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspinb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000359; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000360; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000361; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitea.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000362; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitef.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000363; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stingyscent.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000364; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000365; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000366; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000367; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000368; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storelatest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000369; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenewest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000370; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-theadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000371; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000372; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000373; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000374; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storerecent-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000375; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storespeedy-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000376; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeswift-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000377; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleandhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000378; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"subeamy.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000379; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sugar-legal-about13.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000380; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superiorcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000381; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-club.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000382; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-review.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000383; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000384; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000385; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncgreatly-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000386; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncheavily-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000387; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000388; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000389; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000390; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000391; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000392; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000393; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncintensely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000394; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synclatest-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000395; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncoriginal-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000396; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000397; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000398; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncrenewed-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000399; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000400; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000401; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"talskingest.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000402; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tastefulwood.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000403; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theable.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000404; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000405; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000406; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theconnectvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000407; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecryptomoney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000408; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefatburner.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000409; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefitproject.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000410; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcurve.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000411; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcycle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000412; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthgo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000413; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthpedia.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000414; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthystyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000415; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthyvibe.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000416; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehotshot.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000417; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thelastpicture.show"; content:"Host"; http_header; classtype:web-application-activity; sid:300000418; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenewjourney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000419; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepackage.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000420; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestplayerlinks.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000421; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablealwayssafeupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000422; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000423; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupgrades.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000424; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thrillqueen.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000425; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"toovolution.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000426; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"topnotchsports.tips"; content:"Host"; http_header; classtype:web-application-activity; sid:300000427; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficbounce.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000428; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficgate.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000429; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trkvpn.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000430; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uclaimrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000431; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unequalfaucet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000432; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniremedy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000433; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000434; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000435; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmway.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000436; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecurrent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000437; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000438; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000439; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000440; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatelatest-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000441; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updaterecent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000442; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmakesite.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000443; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000444; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vexearth.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000445; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viral-surveys.win"; content:"Host"; http_header; classtype:web-application-activity; sid:300000446; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralarticles.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000447; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital-health.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000448; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitalrole.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000449; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn-pro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000450; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnadefenceplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000451; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpntool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000452; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"website4all.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000453; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websiteforall.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000454; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websitetoget.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000455; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessgram.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000456; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessplum.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000457; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wherentlybrane.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000458; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wowlifestyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000459; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000460; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000461; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000462; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000463; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnections.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000464; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000465; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000466; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000467; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000468; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000469; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000470; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000471; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000472; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestplayerlink.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000473; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000474; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelink.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000475; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelinks.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000476; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafesystemsupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000477; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourultimateperfectupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000478; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfetinora.tk"; content:"Host"; http_header; classtype:web-application-activity; sid:300000479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"animenation.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000011; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"apptool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000012; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashtdi.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000013; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"assuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000014; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"asufij.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000015; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"auto-lawyer.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000016; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"baseofmp3.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000017; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000018; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000019; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000020; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestresults.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000021; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000022; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000023; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000024; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000025; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigcbd.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000026; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigdaycasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000027; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-trader.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000028; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bittrend.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000029; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"biztherapy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000030; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyamaze.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000031; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyselfcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000032; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"browsercheck.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000033; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcinvesting.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000034; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulley.shop"; content:"Host"; http_header; classtype:web-application-activity; sid:300000035; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabins-r-us.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000036; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"calculateprint.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000037; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carebility.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000038; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carevision.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000039; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"celebseven.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000040; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"centrodeartigos.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000041; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheerplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000042; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"coachbelief.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000043; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"collectrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000044; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"comphp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000045; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceivecolor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000046; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conflaqpzc.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000047; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cooing.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000048; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000049; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-monitor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000050; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-resources.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000051; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotradingcourses.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000052; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptounlimited.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000053; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cs-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000054; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cselfconnect.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000055; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"curesector.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000056; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"degreenm.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000057; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"delightcmain.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000058; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalinvest.news"; content:"Host"; http_header; classtype:web-application-activity; sid:300000059; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"displayfriend.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000060; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ditvl.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000061; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonballclub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000062; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehousan.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000063; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eproute.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000064; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eroanimeittyokusen.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000065; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"erotica.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000066; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"excitingthing.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000067; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrasafe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000068; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-sex.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000069; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000070; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000071; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspotb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000072; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastwebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000073; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmesonlineturbo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000074; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmrod.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000075; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"films-down.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000076; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"financial-deals.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000077; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findforus.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000078; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findoffers.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000079; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces4download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000080; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findyourultimateplayersfirst.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000081; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"firststableplayer.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000082; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisham.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000083; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000084; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandstable.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000085; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitbodyandsoul.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000086; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitcourage.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000087; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspark.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000088; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspot.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000089; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000090; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitlifevalue.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000091; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitnessdial.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000092; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000093; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flatbellylife.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000094; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"foregoingpump.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000095; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"forsalecheap.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000096; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000097; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freshclover.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000098; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuck-me-hard.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000099; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000100; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000101; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000102; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funsiteb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000103; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspinf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000104; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000105; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funwebd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000106; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsxqc.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000107; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gainhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000108; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gapingshame.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000109; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"generouscare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000110; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getstablesystemupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000111; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000112; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladdboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000113; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000114; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladslotweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000115; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000116; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotwonder.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000117; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000118; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000119; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000120; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000121; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000122; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000123; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.store"; content:"Host"; http_header; classtype:web-application-activity; sid:300000124; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"govpshosting.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000125; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"graburprize.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000126; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gramp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000127; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"grandcasinoprize.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000128; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"greatplaceofstubs.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000129; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"greatsearch.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000130; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"growthnetic.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000131; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"hailso.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000132; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"haircarepro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000133; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"happyactive.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000134; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"happymakeworld.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000135; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healandgrow.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000136; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthdefine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000137; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthdome.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000138; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healtheezy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000139; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthemerge.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000140; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthjolly.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000141; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmainly.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000142; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmaintain.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000143; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmama.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000144; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmanic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000145; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthmarlin.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000146; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthneo.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000147; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthomega.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000148; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000149; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthreportsweb.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000150; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthreward.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000151; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthroll.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000152; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthscale.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000153; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthschedule.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000154; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthspark.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000155; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthsupreme.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000156; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthtag.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000157; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthupper.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000158; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthvenue.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000159; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthvibe.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000160; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthwella.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000161; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthy-lifestyle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000162; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthyideal.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000163; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthyparker.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000164; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthysure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000165; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"idtheft-alert.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000166; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iketo.diet"; content:"Host"; http_header; classtype:web-application-activity; sid:300000167; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"inappropriate.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000168; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"information.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000169; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"instablog.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000170; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"insuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000171; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosrecommendedvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000172; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"izipik.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000173; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyplaceplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000174; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotmap.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000175; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000176; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrenthouse.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000177; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jubilantdstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000178; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"kad3md.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000179; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepithealthy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000180; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketodietrecipes.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000181; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"leeching.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000182; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000183; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000184; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000185; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplayerupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000186; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendarysiteupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000187; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000188; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000189; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000190; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"life-esteem.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000191; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifecaregoal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000192; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightstop.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000193; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livehealthcare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000194; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livelyyroad.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000195; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livingmighty.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000196; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadfree-bestheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000197; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000198; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000199; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadheavily-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000200; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loosefit.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000201; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loveorfun.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000202; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckjackcasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000203; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckymedia.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000204; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckymedia.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000205; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"madpandatv.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000206; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"majorhealthpro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000207; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"makemesafeios.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000208; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"managestrong-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000209; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000210; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000211; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000212; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"manageuber-theswiftfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000213; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mathison.io"; content:"Host"; http_header; classtype:web-application-activity; sid:300000214; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"max-care.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000215; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediaplayer24.ml"; content:"Host"; http_header; classtype:web-application-activity; sid:300000216; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicomatic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000217; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medjournalketo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000218; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"medsjournal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000219; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeryslotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000220; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"merryplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000221; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"merryplayworld.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000222; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mindbank.ai"; content:"Host"; http_header; classtype:web-application-activity; sid:300000223; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mindmatch.ai"; content:"Host"; http_header; classtype:web-application-activity; sid:300000224; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"mistraffic.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000225; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"modern-security.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000226; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"monitoring-credit.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000227; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"multitax.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000228; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"newsitedowloads.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000229; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nogfw.pro"; content:"Host"; http_header; classtype:web-application-activity; sid:300000230; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nosyknot.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000231; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"nutrinamic.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000232; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"onegowc.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000233; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecinema.eu"; content:"Host"; http_header; classtype:web-application-activity; sid:300000234; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatecompletely-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000235; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatecompletely-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000236; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateextremely-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000237; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateextremely-therenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000238; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatefree-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000239; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operategreatly-therefinedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000240; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operategreatly-theswiftfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000241; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatehighly-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000242; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatehighly-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000243; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateintensely-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000244; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateintensely-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000245; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatenewest-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000246; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoriginal-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000247; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoriginal-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000248; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateoverly-thesophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000249; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateprecise-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000250; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateprogressive-theintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000251; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatequick-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000252; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operaterefined-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000253; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operaterenewed-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000254; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatesophisticated-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000255; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatespeedy-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000256; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateuber-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000257; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"operateuber-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000258; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"patriothealth.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000259; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcicompliancemanager.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000260; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectplaceonnetforplayers.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000261; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performcompletely-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000262; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performcompletely-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000263; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performextremely-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000264; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performfree-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000265; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performgreatly-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000266; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performheavily-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000267; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000268; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-theprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000269; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performhighly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000270; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performintensely-thedevelopedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000271; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performlatest-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000272; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performmost-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000273; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performmost-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000274; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoriginal-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000275; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoriginal-theuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000276; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performoverly-theprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000277; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprecise-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000278; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprecise-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000279; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprogressive-theintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000280; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performprogressive-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000281; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performquick-thecompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000282; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrecent-themostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000283; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrefined-theextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000284; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performrenewed-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000285; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performsophisticated-thehighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000286; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performspeedy-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000287; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performuber-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000288; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"performuber-therenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000289; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"piorkeepi.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000290; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"placesiteb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000291; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"placesitee.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000292; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"placewebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000293; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"plampo.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000294; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspina.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000295; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspind.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000296; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"playspote.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000297; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"premiernursingacademy.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000298; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"preparedforsafeupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000299; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primawise.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000300; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primecare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000301; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"productiq.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000302; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"prohealthroutine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000303; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-connection.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000304; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protectyourvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000305; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"readyhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000306; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"readyhealthgo.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000307; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000308; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000309; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000310; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000311; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000312; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000313; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"recontent.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000314; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliablesoftwarevideos.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000315; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"remedify.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000316; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000317; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000318; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000319; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000320; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"renewvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000321; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"resignation.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000322; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"roadtoyourhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000323; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"robogarden.io"; content:"Host"; http_header; classtype:web-application-activity; sid:300000324; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rootessential.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000325; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rotharbor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000326; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runadvanced-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000327; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runcurrent-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000328; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rundeveloped-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000329; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000330; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestcurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000331; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000332; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runextremely-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000333; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runfree-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000334; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runintensely-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000335; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runlatest-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000336; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runnewest-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000337; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoriginal-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000338; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoriginal-bestintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000339; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestdevelopedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000340; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000341; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runoverly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000342; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runrecent-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000343; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"runrecent-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000344; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safelyonline.tech"; content:"Host"; http_header; classtype:web-application-activity; sid:300000345; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safest4placeupdate.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000346; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"safest4placeupdates.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000347; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"scheduleagreement.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000348; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"score-monitoring.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000349; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"search-tool.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000350; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"search-trends.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000351; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"searchfeed.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000352; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-alert.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000353; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000354; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-monitoring.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000355; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"second-handjam.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000356; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-made-easy.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000357; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-pro.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000358; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-protection.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000359; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"seemlast.monster"; content:"Host"; http_header; classtype:web-application-activity; sid:300000360; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"selfradiance.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000361; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shkshk.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000362; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopnsave.world"; content:"Host"; http_header; classtype:web-application-activity; sid:300000363; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shoppingexp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000364; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartys.link"; content:"Host"; http_header; classtype:web-application-activity; sid:300000365; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000366; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspinb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000367; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000368; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000369; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitea.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000370; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitef.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000371; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stingyscent.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000372; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000373; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000374; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000375; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000376; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storelatest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000377; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenewest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000378; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-theadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000379; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000380; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000381; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000382; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storerecent-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000383; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storespeedy-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000384; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeswift-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000385; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleandhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000386; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"subeamy.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000387; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sugar-legal-about13.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000388; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superiorcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000389; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-club.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000390; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-review.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000391; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000392; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000393; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncgreatly-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000394; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncheavily-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000395; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000396; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000397; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000398; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000399; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000400; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000401; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncintensely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000402; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synclatest-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000403; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncoriginal-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000404; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000405; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000406; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncrenewed-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000407; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000408; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000409; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tackis.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000410; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"talskingest.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000411; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tastefulwood.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000412; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theable.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000413; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000414; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000415; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theconnectvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000416; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecryptomoney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000417; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefatburner.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000418; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefitproject.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000419; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcurve.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000420; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcycle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000421; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthgo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000422; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthpedia.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000423; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthystyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000424; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthyvibe.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000425; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehotshot.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000426; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenewjourney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000427; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepackage.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000428; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestplayerlinks.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000429; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theslotomania.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000430; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablealwayssafeupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000431; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000432; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupgrades.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000433; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thrillqueen.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000434; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"toovolution.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000435; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"topnotchsports.tips"; content:"Host"; http_header; classtype:web-application-activity; sid:300000436; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficbounce.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000437; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficgate.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000438; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trkvpn.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000439; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uclaimrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000440; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unequalfaucet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000441; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniremedy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000442; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000443; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000444; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmway.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000445; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecurrent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000446; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000447; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000448; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000449; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatelatest-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000450; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updaterecent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000451; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmakesite.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000452; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000453; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vexearth.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000454; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viral-surveys.win"; content:"Host"; http_header; classtype:web-application-activity; sid:300000455; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralarticles.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000456; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital-health.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000457; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitalrole.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000458; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn-pro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000459; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnadefenceplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000460; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpntool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000461; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"website4all.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000462; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websiteforall.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000463; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websitetoget.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000464; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"webtip.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000465; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessgram.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000466; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessplum.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000467; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wherentlybrane.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000468; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wowlifestyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000469; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000470; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000471; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000472; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000473; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnections.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000474; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000475; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000476; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000477; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000478; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000480; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000481; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000482; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestplayerlink.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000483; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000484; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelink.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000485; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelinks.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000486; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafesystemsupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000487; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourultimateperfectupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000488; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfetinora.tk"; content:"Host"; http_header; classtype:web-application-activity; sid:300000489; rev:1;) diff --git a/dist/pup-filter-snort3.rules b/dist/pup-filter-snort3.rules index 477c8fa..0892b3a 100644 --- a/dist/pup-filter-snort3.rules +++ b/dist/pup-filter-snort3.rules @@ -1,6 +1,6 @@ # Title: PUP Domains Snort3 Ruleset # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,479 +8,489 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"123news.website",nocase; classtype:web-application-activity; sid:300000001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"20patogh.com",nocase; classtype:web-application-activity; sid:300000002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"321movies.xyz",nocase; classtype:web-application-activity; sid:300000003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"4uabs.club",nocase; classtype:web-application-activity; sid:300000004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"7awwa2.xyz",nocase; classtype:web-application-activity; sid:300000005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"7awwa2.xyz",nocase; classtype:web-application-activity; sid:300000004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"abcscience.xyz",nocase; classtype:web-application-activity; sid:300000005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"abeah-security.xyz",nocase; classtype:web-application-activity; sid:300000006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"adrondespi.top",nocase; classtype:web-application-activity; sid:300000007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"advancecare.info",nocase; classtype:web-application-activity; sid:300000008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"akb48wrapup.com",nocase; classtype:web-application-activity; sid:300000009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"amateurxporn.com",nocase; classtype:web-application-activity; sid:300000010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"apptool.me",nocase; classtype:web-application-activity; sid:300000011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ashtdi.cn",nocase; classtype:web-application-activity; sid:300000012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"assuredhealth.info",nocase; classtype:web-application-activity; sid:300000013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"asufij.xyz",nocase; classtype:web-application-activity; sid:300000014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"auto-lawyer.site",nocase; classtype:web-application-activity; sid:300000015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"baseofmp3.com",nocase; classtype:web-application-activity; sid:300000016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestresults.xyz",nocase; classtype:web-application-activity; sid:300000020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayer.info",nocase; classtype:web-application-activity; sid:300000023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayers.info",nocase; classtype:web-application-activity; sid:300000024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigcbd.info",nocase; classtype:web-application-activity; sid:300000025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigdaycasino.info",nocase; classtype:web-application-activity; sid:300000026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoin-trader.me",nocase; classtype:web-application-activity; sid:300000027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bittrend.com",nocase; classtype:web-application-activity; sid:300000028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"biztherapy.info",nocase; classtype:web-application-activity; sid:300000029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyamaze.club",nocase; classtype:web-application-activity; sid:300000030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyselfcare.info",nocase; classtype:web-application-activity; sid:300000031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"browsercheck.site",nocase; classtype:web-application-activity; sid:300000032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bulley.shop",nocase; classtype:web-application-activity; sid:300000033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cabins-r-us.com",nocase; classtype:web-application-activity; sid:300000034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"calculateprint.xyz",nocase; classtype:web-application-activity; sid:300000035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"care-connection.info",nocase; classtype:web-application-activity; sid:300000036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carebility.info",nocase; classtype:web-application-activity; sid:300000037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carevision.info",nocase; classtype:web-application-activity; sid:300000038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"celebseven.com",nocase; classtype:web-application-activity; sid:300000039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"centrodeartigos.com",nocase; classtype:web-application-activity; sid:300000040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cheerplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"coachbelief.xyz",nocase; classtype:web-application-activity; sid:300000042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"collectrewards.net",nocase; classtype:web-application-activity; sid:300000043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"comphp.xyz",nocase; classtype:web-application-activity; sid:300000044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conceivecolor.xyz",nocase; classtype:web-application-activity; sid:300000045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conflaqpzc.info",nocase; classtype:web-application-activity; sid:300000046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cooing.top",nocase; classtype:web-application-activity; sid:300000047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-alerts.xyz",nocase; classtype:web-application-activity; sid:300000048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-monitor.xyz",nocase; classtype:web-application-activity; sid:300000049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-resources.xyz",nocase; classtype:web-application-activity; sid:300000050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotradingcourses.net",nocase; classtype:web-application-activity; sid:300000051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptounlimited.info",nocase; classtype:web-application-activity; sid:300000052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cs-alerts.xyz",nocase; classtype:web-application-activity; sid:300000053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cselfconnect.com",nocase; classtype:web-application-activity; sid:300000054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"curesector.today",nocase; classtype:web-application-activity; sid:300000055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"degreenm.top",nocase; classtype:web-application-activity; sid:300000056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"delightcmain.xyz",nocase; classtype:web-application-activity; sid:300000057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"digitalinvest.news",nocase; classtype:web-application-activity; sid:300000058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"displayfriend.xyz",nocase; classtype:web-application-activity; sid:300000059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ditvl.com",nocase; classtype:web-application-activity; sid:300000060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dragonballclub.com",nocase; classtype:web-application-activity; sid:300000061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ehousan.top",nocase; classtype:web-application-activity; sid:300000062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eproute.info",nocase; classtype:web-application-activity; sid:300000063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eroanimeittyokusen.com",nocase; classtype:web-application-activity; sid:300000064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"erotica.live",nocase; classtype:web-application-activity; sid:300000065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"excitingthing.xyz",nocase; classtype:web-application-activity; sid:300000066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"extrasafe.xyz",nocase; classtype:web-application-activity; sid:300000067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"facebook-sex.com",nocase; classtype:web-application-activity; sid:300000068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapf.xyz",nocase; classtype:web-application-activity; sid:300000069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastplanetf.xyz",nocase; classtype:web-application-activity; sid:300000070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspotb.xyz",nocase; classtype:web-application-activity; sid:300000071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastwebe.xyz",nocase; classtype:web-application-activity; sid:300000072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmesonlineturbo.net",nocase; classtype:web-application-activity; sid:300000073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmrod.xyz",nocase; classtype:web-application-activity; sid:300000074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"films-down.com",nocase; classtype:web-application-activity; sid:300000075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"financial-deals.xyz",nocase; classtype:web-application-activity; sid:300000076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findoffers.co",nocase; classtype:web-application-activity; sid:300000077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces4download.work",nocase; classtype:web-application-activity; sid:300000078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findyourultimateplayersfirst.best",nocase; classtype:web-application-activity; sid:300000079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"firststableplayer.work",nocase; classtype:web-application-activity; sid:300000080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fisham.site",nocase; classtype:web-application-activity; sid:300000081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandready.info",nocase; classtype:web-application-activity; sid:300000082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandstable.club",nocase; classtype:web-application-activity; sid:300000083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitbodyandsoul.info",nocase; classtype:web-application-activity; sid:300000084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitcourage.info",nocase; classtype:web-application-activity; sid:300000085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspark.info",nocase; classtype:web-application-activity; sid:300000086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspot.club",nocase; classtype:web-application-activity; sid:300000087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthsure.info",nocase; classtype:web-application-activity; sid:300000088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitlifevalue.info",nocase; classtype:web-application-activity; sid:300000089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitnessdial.club",nocase; classtype:web-application-activity; sid:300000090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitsure.info",nocase; classtype:web-application-activity; sid:300000091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flatbellylife.info",nocase; classtype:web-application-activity; sid:300000092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"foregoingpump.xyz",nocase; classtype:web-application-activity; sid:300000093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"forsalecheap.net",nocase; classtype:web-application-activity; sid:300000094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrade.work",nocase; classtype:web-application-activity; sid:300000095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freshclover.info",nocase; classtype:web-application-activity; sid:300000096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fuck-me-hard.club",nocase; classtype:web-application-activity; sid:300000097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapc.xyz",nocase; classtype:web-application-activity; sid:300000098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapd.xyz",nocase; classtype:web-application-activity; sid:300000099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funplanetb.xyz",nocase; classtype:web-application-activity; sid:300000100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funsiteb.xyz",nocase; classtype:web-application-activity; sid:300000101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspinf.xyz",nocase; classtype:web-application-activity; sid:300000102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspotf.xyz",nocase; classtype:web-application-activity; sid:300000103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funwebd.xyz",nocase; classtype:web-application-activity; sid:300000104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fwsxqc.cn",nocase; classtype:web-application-activity; sid:300000105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gainhealth.info",nocase; classtype:web-application-activity; sid:300000106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gapingshame.xyz",nocase; classtype:web-application-activity; sid:300000107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"generouscare.info",nocase; classtype:web-application-activity; sid:300000108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getstablesystemupgrades.work",nocase; classtype:web-application-activity; sid:300000109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladdboulevard.xyz",nocase; classtype:web-application-activity; sid:300000111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladslotweb.xyz",nocase; classtype:web-application-activity; sid:300000113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotplay.xyz",nocase; classtype:web-application-activity; sid:300000114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotwonder.xyz",nocase; classtype:web-application-activity; sid:300000115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.fun",nocase; classtype:web-application-activity; sid:300000116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.online",nocase; classtype:web-application-activity; sid:300000117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.site",nocase; classtype:web-application-activity; sid:300000118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.surf",nocase; classtype:web-application-activity; sid:300000119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.website",nocase; classtype:web-application-activity; sid:300000120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.fun",nocase; classtype:web-application-activity; sid:300000121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.store",nocase; classtype:web-application-activity; sid:300000122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"govpshosting.com",nocase; classtype:web-application-activity; sid:300000123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"graburprize.net",nocase; classtype:web-application-activity; sid:300000124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gramp.xyz",nocase; classtype:web-application-activity; sid:300000125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"grandcasinoprize.info",nocase; classtype:web-application-activity; sid:300000126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"greatplaceofstubs.work",nocase; classtype:web-application-activity; sid:300000127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"growthnetic.club",nocase; classtype:web-application-activity; sid:300000128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"hailso.xyz",nocase; classtype:web-application-activity; sid:300000129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"haircarepro.info",nocase; classtype:web-application-activity; sid:300000130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"happyactive.today",nocase; classtype:web-application-activity; sid:300000131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"happymakeworld.xyz",nocase; classtype:web-application-activity; sid:300000132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthdefine.info",nocase; classtype:web-application-activity; sid:300000133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthdome.info",nocase; classtype:web-application-activity; sid:300000134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healtheezy.info",nocase; classtype:web-application-activity; sid:300000135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthemerge.info",nocase; classtype:web-application-activity; sid:300000136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthjolly.info",nocase; classtype:web-application-activity; sid:300000137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmainly.info",nocase; classtype:web-application-activity; sid:300000138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmaintain.info",nocase; classtype:web-application-activity; sid:300000139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmama.info",nocase; classtype:web-application-activity; sid:300000140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmanic.info",nocase; classtype:web-application-activity; sid:300000141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmarlin.club",nocase; classtype:web-application-activity; sid:300000142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthneo.club",nocase; classtype:web-application-activity; sid:300000143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthomega.club",nocase; classtype:web-application-activity; sid:300000144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthready.info",nocase; classtype:web-application-activity; sid:300000145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthreportsweb.info",nocase; classtype:web-application-activity; sid:300000146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthreward.info",nocase; classtype:web-application-activity; sid:300000147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthroll.info",nocase; classtype:web-application-activity; sid:300000148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthscale.club",nocase; classtype:web-application-activity; sid:300000149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthschedule.club",nocase; classtype:web-application-activity; sid:300000150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthspark.today",nocase; classtype:web-application-activity; sid:300000151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthsupreme.club",nocase; classtype:web-application-activity; sid:300000152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthtag.club",nocase; classtype:web-application-activity; sid:300000153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthupper.club",nocase; classtype:web-application-activity; sid:300000154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthvenue.club",nocase; classtype:web-application-activity; sid:300000155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthvibe.live",nocase; classtype:web-application-activity; sid:300000156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthwella.club",nocase; classtype:web-application-activity; sid:300000157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthy-lifestyle.club",nocase; classtype:web-application-activity; sid:300000158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthyideal.club",nocase; classtype:web-application-activity; sid:300000159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthyparker.info",nocase; classtype:web-application-activity; sid:300000160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthysure.info",nocase; classtype:web-application-activity; sid:300000161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"idtheft-alert.xyz",nocase; classtype:web-application-activity; sid:300000162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iketo.diet",nocase; classtype:web-application-activity; sid:300000163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"inappropriate.top",nocase; classtype:web-application-activity; sid:300000164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"information.casa",nocase; classtype:web-application-activity; sid:300000165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"instablog.club",nocase; classtype:web-application-activity; sid:300000166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"insuredhealth.info",nocase; classtype:web-application-activity; sid:300000167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosrecommendedvpn.com",nocase; classtype:web-application-activity; sid:300000168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"izipik.com",nocase; classtype:web-application-activity; sid:300000169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyplaceplay.xyz",nocase; classtype:web-application-activity; sid:300000170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotmap.xyz",nocase; classtype:web-application-activity; sid:300000171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotspin.xyz",nocase; classtype:web-application-activity; sid:300000172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jsrenthouse.com",nocase; classtype:web-application-activity; sid:300000173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jubilantdstreet.xyz",nocase; classtype:web-application-activity; sid:300000174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"kad3md.cn",nocase; classtype:web-application-activity; sid:300000175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"keepithealthy.info",nocase; classtype:web-application-activity; sid:300000176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ketodietrecipes.org",nocase; classtype:web-application-activity; sid:300000177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"leeching.net",nocase; classtype:web-application-activity; sid:300000178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrading.info",nocase; classtype:web-application-activity; sid:300000181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplayerupdates.work",nocase; classtype:web-application-activity; sid:300000182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendarysiteupgrading.work",nocase; classtype:web-application-activity; sid:300000183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrade.info",nocase; classtype:web-application-activity; sid:300000184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"life-esteem.info",nocase; classtype:web-application-activity; sid:300000187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lifecaregoal.info",nocase; classtype:web-application-activity; sid:300000188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lightstop.xyz",nocase; classtype:web-application-activity; sid:300000189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livehealthcare.today",nocase; classtype:web-application-activity; sid:300000190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livelyyroad.xyz",nocase; classtype:web-application-activity; sid:300000191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livingmighty.club",nocase; classtype:web-application-activity; sid:300000192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadfree-bestheavilyfile.best",nocase; classtype:web-application-activity; sid:300000193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadheavily-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loosefit.info",nocase; classtype:web-application-activity; sid:300000197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loveorfun.cc",nocase; classtype:web-application-activity; sid:300000198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckjackcasino.info",nocase; classtype:web-application-activity; sid:300000199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckymedia.fun",nocase; classtype:web-application-activity; sid:300000200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckymedia.space",nocase; classtype:web-application-activity; sid:300000201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"madpandatv.net",nocase; classtype:web-application-activity; sid:300000202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"majorhealthpro.info",nocase; classtype:web-application-activity; sid:300000203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"makemesafeios.com",nocase; classtype:web-application-activity; sid:300000204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"managestrong-theuberfile.best",nocase; classtype:web-application-activity; sid:300000205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-therecentfile.best",nocase; classtype:web-application-activity; sid:300000207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-theswiftfile.best",nocase; classtype:web-application-activity; sid:300000209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mathison.io",nocase; classtype:web-application-activity; sid:300000210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"max-care.info",nocase; classtype:web-application-activity; sid:300000211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mediaplayer24.ml",nocase; classtype:web-application-activity; sid:300000212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medicomatic.info",nocase; classtype:web-application-activity; sid:300000213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medjournalketo.info",nocase; classtype:web-application-activity; sid:300000214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medsjournal.info",nocase; classtype:web-application-activity; sid:300000215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"meeryslotspin.xyz",nocase; classtype:web-application-activity; sid:300000216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"merryplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"merryplayworld.xyz",nocase; classtype:web-application-activity; sid:300000218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mindmatch.ai",nocase; classtype:web-application-activity; sid:300000219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mistraffic.me",nocase; classtype:web-application-activity; sid:300000220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"modern-security.xyz",nocase; classtype:web-application-activity; sid:300000221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"monitoring-credit.xyz",nocase; classtype:web-application-activity; sid:300000222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"multitax.xyz",nocase; classtype:web-application-activity; sid:300000223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"newsitedowloads.site",nocase; classtype:web-application-activity; sid:300000224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nogfw.pro",nocase; classtype:web-application-activity; sid:300000225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nosyknot.xyz",nocase; classtype:web-application-activity; sid:300000226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nutrinamic.info",nocase; classtype:web-application-activity; sid:300000227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"onegowc.pw",nocase; classtype:web-application-activity; sid:300000228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatecompletely-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatecompletely-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateextremely-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateextremely-therenewedfile.best",nocase; classtype:web-application-activity; sid:300000232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatefree-theuberfile.best",nocase; classtype:web-application-activity; sid:300000233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operategreatly-therefinedfile.best",nocase; classtype:web-application-activity; sid:300000234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operategreatly-theswiftfile.best",nocase; classtype:web-application-activity; sid:300000235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatehighly-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatehighly-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateintensely-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateintensely-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatenewest-theuberfile.best",nocase; classtype:web-application-activity; sid:300000240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoriginal-themostfile.best",nocase; classtype:web-application-activity; sid:300000241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoriginal-theuberfile.best",nocase; classtype:web-application-activity; sid:300000242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoverly-thesophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateprecise-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateprogressive-theintenselyfile.best",nocase; classtype:web-application-activity; sid:300000245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatequick-themostfile.best",nocase; classtype:web-application-activity; sid:300000246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operaterefined-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operaterenewed-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatesophisticated-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatespeedy-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateuber-thefreefile.best",nocase; classtype:web-application-activity; sid:300000251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateuber-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"patriothealth.today",nocase; classtype:web-application-activity; sid:300000253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"pcicompliancemanager.xyz",nocase; classtype:web-application-activity; sid:300000254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"perfectplaceonnetforplayers.work",nocase; classtype:web-application-activity; sid:300000255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performcompletely-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performcompletely-thequickfile.best",nocase; classtype:web-application-activity; sid:300000257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performextremely-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performfree-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performgreatly-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performheavily-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-thefreefile.best",nocase; classtype:web-application-activity; sid:300000262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performintensely-thedevelopedfile.best",nocase; classtype:web-application-activity; sid:300000265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performlatest-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performmost-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performmost-therecentfile.best",nocase; classtype:web-application-activity; sid:300000268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoriginal-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoriginal-theuberfile.best",nocase; classtype:web-application-activity; sid:300000270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoverly-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprecise-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprecise-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprogressive-theintenselyfile.best",nocase; classtype:web-application-activity; sid:300000274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprogressive-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performquick-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrecent-themostfile.best",nocase; classtype:web-application-activity; sid:300000277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrefined-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrenewed-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performsophisticated-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performspeedy-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performuber-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performuber-therenewedfile.best",nocase; classtype:web-application-activity; sid:300000283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"piorkeepi.top",nocase; classtype:web-application-activity; sid:300000284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"placesitee.xyz",nocase; classtype:web-application-activity; sid:300000285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"placewebe.xyz",nocase; classtype:web-application-activity; sid:300000286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"plampo.xyz",nocase; classtype:web-application-activity; sid:300000287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspina.xyz",nocase; classtype:web-application-activity; sid:300000288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspind.xyz",nocase; classtype:web-application-activity; sid:300000289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspote.xyz",nocase; classtype:web-application-activity; sid:300000290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"premiernursingacademy.org",nocase; classtype:web-application-activity; sid:300000291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"preparedforsafeupgrading.work",nocase; classtype:web-application-activity; sid:300000292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primawise.info",nocase; classtype:web-application-activity; sid:300000293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primecare.today",nocase; classtype:web-application-activity; sid:300000294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"prohealthroutine.info",nocase; classtype:web-application-activity; sid:300000295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protect-connection.com",nocase; classtype:web-application-activity; sid:300000296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protectyourvpn.com",nocase; classtype:web-application-activity; sid:300000297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"readyhealth.info",nocase; classtype:web-application-activity; sid:300000298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"readyhealthgo.today",nocase; classtype:web-application-activity; sid:300000299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.casa",nocase; classtype:web-application-activity; sid:300000300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.cyou",nocase; classtype:web-application-activity; sid:300000301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.fun",nocase; classtype:web-application-activity; sid:300000302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.site",nocase; classtype:web-application-activity; sid:300000303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.space",nocase; classtype:web-application-activity; sid:300000304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.surf",nocase; classtype:web-application-activity; sid:300000305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.website",nocase; classtype:web-application-activity; sid:300000306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"reliablesoftwarevideos.info",nocase; classtype:web-application-activity; sid:300000307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"remedify.info",nocase; classtype:web-application-activity; sid:300000308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.casa",nocase; classtype:web-application-activity; sid:300000309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.fun",nocase; classtype:web-application-activity; sid:300000310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.online",nocase; classtype:web-application-activity; sid:300000311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.site",nocase; classtype:web-application-activity; sid:300000312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.website",nocase; classtype:web-application-activity; sid:300000313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"resignation.top",nocase; classtype:web-application-activity; sid:300000314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"roadtoyourhealth.info",nocase; classtype:web-application-activity; sid:300000315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"robogarden.io",nocase; classtype:web-application-activity; sid:300000316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rootessential.info",nocase; classtype:web-application-activity; sid:300000317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rotharbor.xyz",nocase; classtype:web-application-activity; sid:300000318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runadvanced-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runcurrent-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rundeveloped-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestcurrentfile.best",nocase; classtype:web-application-activity; sid:300000323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runfree-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runintensely-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runlatest-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runnewest-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoriginal-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoriginal-bestintenselyfile.best",nocase; classtype:web-application-activity; sid:300000331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestdevelopedfile.best",nocase; classtype:web-application-activity; sid:300000332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runrecent-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runrecent-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safelyonline.tech",nocase; classtype:web-application-activity; sid:300000337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safest4placeupdate.info",nocase; classtype:web-application-activity; sid:300000338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safest4placeupdates.info",nocase; classtype:web-application-activity; sid:300000339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"scheduleagreement.xyz",nocase; classtype:web-application-activity; sid:300000340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"score-monitoring.xyz",nocase; classtype:web-application-activity; sid:300000341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"search-tool.net",nocase; classtype:web-application-activity; sid:300000342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"search-trends.co",nocase; classtype:web-application-activity; sid:300000343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"searchfeed.co",nocase; classtype:web-application-activity; sid:300000344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-alert.xyz",nocase; classtype:web-application-activity; sid:300000345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-alerts.xyz",nocase; classtype:web-application-activity; sid:300000346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-monitoring.xyz",nocase; classtype:web-application-activity; sid:300000347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"second-handjam.xyz",nocase; classtype:web-application-activity; sid:300000348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-made-easy.xyz",nocase; classtype:web-application-activity; sid:300000349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-pro.xyz",nocase; classtype:web-application-activity; sid:300000350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-protection.xyz",nocase; classtype:web-application-activity; sid:300000351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"seemlast.monster",nocase; classtype:web-application-activity; sid:300000352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"selfradiance.info",nocase; classtype:web-application-activity; sid:300000353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shkshk.site",nocase; classtype:web-application-activity; sid:300000354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shopnsave.world",nocase; classtype:web-application-activity; sid:300000355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shoppingexp.xyz",nocase; classtype:web-application-activity; sid:300000356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"smartys.link",nocase; classtype:web-application-activity; sid:300000357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetd.xyz",nocase; classtype:web-application-activity; sid:300000358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspinb.xyz",nocase; classtype:web-application-activity; sid:300000359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspotf.xyz",nocase; classtype:web-application-activity; sid:300000360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetb.xyz",nocase; classtype:web-application-activity; sid:300000361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitea.xyz",nocase; classtype:web-application-activity; sid:300000362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitef.xyz",nocase; classtype:web-application-activity; sid:300000363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stingyscent.xyz",nocase; classtype:web-application-activity; sid:300000364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thefreefile.best",nocase; classtype:web-application-activity; sid:300000365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thequickfile.best",nocase; classtype:web-application-activity; sid:300000366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storelatest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storenewest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-theadvancedfile.best",nocase; classtype:web-application-activity; sid:300000371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storerecent-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storespeedy-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeswift-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"styleandhealth.info",nocase; classtype:web-application-activity; sid:300000378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"subeamy.pw",nocase; classtype:web-application-activity; sid:300000379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sugar-legal-about13.fun",nocase; classtype:web-application-activity; sid:300000380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superiorcare.info",nocase; classtype:web-application-activity; sid:300000381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-club.club",nocase; classtype:web-application-activity; sid:300000382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-review.club",nocase; classtype:web-application-activity; sid:300000383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncgreatly-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncheavily-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncintensely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synclatest-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncoriginal-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncrenewed-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"talskingest.top",nocase; classtype:web-application-activity; sid:300000402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tastefulwood.xyz",nocase; classtype:web-application-activity; sid:300000403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theable.me",nocase; classtype:web-application-activity; sid:300000404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theconnectvpn.com",nocase; classtype:web-application-activity; sid:300000407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thecryptomoney.info",nocase; classtype:web-application-activity; sid:300000408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefatburner.info",nocase; classtype:web-application-activity; sid:300000409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefitproject.club",nocase; classtype:web-application-activity; sid:300000410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcurve.info",nocase; classtype:web-application-activity; sid:300000411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcycle.club",nocase; classtype:web-application-activity; sid:300000412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthgo.info",nocase; classtype:web-application-activity; sid:300000413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthpedia.info",nocase; classtype:web-application-activity; sid:300000414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthystyle.info",nocase; classtype:web-application-activity; sid:300000415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthyvibe.info",nocase; classtype:web-application-activity; sid:300000416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehotshot.info",nocase; classtype:web-application-activity; sid:300000417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thelastpicture.show",nocase; classtype:web-application-activity; sid:300000418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thenewjourney.info",nocase; classtype:web-application-activity; sid:300000419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thepackage.club",nocase; classtype:web-application-activity; sid:300000420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestplayerlinks.work",nocase; classtype:web-application-activity; sid:300000421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablealwayssafeupdates.work",nocase; classtype:web-application-activity; sid:300000422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupgrades.best",nocase; classtype:web-application-activity; sid:300000424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thrillqueen.xyz",nocase; classtype:web-application-activity; sid:300000425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"toovolution.club",nocase; classtype:web-application-activity; sid:300000426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"topnotchsports.tips",nocase; classtype:web-application-activity; sid:300000427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficbounce.net",nocase; classtype:web-application-activity; sid:300000428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficgate.cc",nocase; classtype:web-application-activity; sid:300000429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trkvpn.xyz",nocase; classtype:web-application-activity; sid:300000430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uclaimrewards.net",nocase; classtype:web-application-activity; sid:300000431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unequalfaucet.xyz",nocase; classtype:web-application-activity; sid:300000432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uniremedy.info",nocase; classtype:web-application-activity; sid:300000433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmstreet.xyz",nocase; classtype:web-application-activity; sid:300000435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmway.xyz",nocase; classtype:web-application-activity; sid:300000436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatecurrent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatelatest-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updaterecent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upmakesite.xyz",nocase; classtype:web-application-activity; sid:300000443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vexearth.xyz",nocase; classtype:web-application-activity; sid:300000445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viral-surveys.win",nocase; classtype:web-application-activity; sid:300000446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viralarticles.net",nocase; classtype:web-application-activity; sid:300000447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vital-health.club",nocase; classtype:web-application-activity; sid:300000448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vitalrole.info",nocase; classtype:web-application-activity; sid:300000449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn-pro.info",nocase; classtype:web-application-activity; sid:300000450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnadefenceplus.com",nocase; classtype:web-application-activity; sid:300000451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpntool.me",nocase; classtype:web-application-activity; sid:300000452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"website4all.info",nocase; classtype:web-application-activity; sid:300000453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websiteforall.work",nocase; classtype:web-application-activity; sid:300000454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websitetoget.work",nocase; classtype:web-application-activity; sid:300000455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessgram.info",nocase; classtype:web-application-activity; sid:300000456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessplum.info",nocase; classtype:web-application-activity; sid:300000457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wherentlybrane.site",nocase; classtype:web-application-activity; sid:300000458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wowlifestyle.info",nocase; classtype:web-application-activity; sid:300000459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnection.info",nocase; classtype:web-application-activity; sid:300000463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnections.info",nocase; classtype:web-application-activity; sid:300000464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdate.work",nocase; classtype:web-application-activity; sid:300000469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdating.work",nocase; classtype:web-application-activity; sid:300000470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestplayerlink.best",nocase; classtype:web-application-activity; sid:300000473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelink.info",nocase; classtype:web-application-activity; sid:300000475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelinks.info",nocase; classtype:web-application-activity; sid:300000476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafesystemsupdating.work",nocase; classtype:web-application-activity; sid:300000477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourultimateperfectupgrades.work",nocase; classtype:web-application-activity; sid:300000478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ysfetinora.tk",nocase; classtype:web-application-activity; sid:300000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"animenation.org",nocase; classtype:web-application-activity; sid:300000011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"apptool.me",nocase; classtype:web-application-activity; sid:300000012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ashtdi.cn",nocase; classtype:web-application-activity; sid:300000013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"assuredhealth.info",nocase; classtype:web-application-activity; sid:300000014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"asufij.xyz",nocase; classtype:web-application-activity; sid:300000015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"auto-lawyer.site",nocase; classtype:web-application-activity; sid:300000016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"baseofmp3.com",nocase; classtype:web-application-activity; sid:300000017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestresults.xyz",nocase; classtype:web-application-activity; sid:300000021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayer.info",nocase; classtype:web-application-activity; sid:300000024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayers.info",nocase; classtype:web-application-activity; sid:300000025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigcbd.info",nocase; classtype:web-application-activity; sid:300000026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigdaycasino.info",nocase; classtype:web-application-activity; sid:300000027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoin-trader.me",nocase; classtype:web-application-activity; sid:300000028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bittrend.com",nocase; classtype:web-application-activity; sid:300000029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"biztherapy.info",nocase; classtype:web-application-activity; sid:300000030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyamaze.club",nocase; classtype:web-application-activity; sid:300000031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyselfcare.info",nocase; classtype:web-application-activity; sid:300000032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"browsercheck.site",nocase; classtype:web-application-activity; sid:300000033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"btcinvesting.info",nocase; classtype:web-application-activity; sid:300000034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bulley.shop",nocase; classtype:web-application-activity; sid:300000035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cabins-r-us.com",nocase; classtype:web-application-activity; sid:300000036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"calculateprint.xyz",nocase; classtype:web-application-activity; sid:300000037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carebility.info",nocase; classtype:web-application-activity; sid:300000038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carevision.info",nocase; classtype:web-application-activity; sid:300000039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"celebseven.com",nocase; classtype:web-application-activity; sid:300000040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"centrodeartigos.com",nocase; classtype:web-application-activity; sid:300000041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cheerplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"coachbelief.xyz",nocase; classtype:web-application-activity; sid:300000043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"collectrewards.net",nocase; classtype:web-application-activity; sid:300000044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"comphp.xyz",nocase; classtype:web-application-activity; sid:300000045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conceivecolor.xyz",nocase; classtype:web-application-activity; sid:300000046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conflaqpzc.info",nocase; classtype:web-application-activity; sid:300000047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cooing.top",nocase; classtype:web-application-activity; sid:300000048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-alerts.xyz",nocase; classtype:web-application-activity; sid:300000049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-monitor.xyz",nocase; classtype:web-application-activity; sid:300000050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-resources.xyz",nocase; classtype:web-application-activity; sid:300000051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotradingcourses.net",nocase; classtype:web-application-activity; sid:300000052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptounlimited.info",nocase; classtype:web-application-activity; sid:300000053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cs-alerts.xyz",nocase; classtype:web-application-activity; sid:300000054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cselfconnect.com",nocase; classtype:web-application-activity; sid:300000055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"curesector.today",nocase; classtype:web-application-activity; sid:300000056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"degreenm.top",nocase; classtype:web-application-activity; sid:300000057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"delightcmain.xyz",nocase; classtype:web-application-activity; sid:300000058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"digitalinvest.news",nocase; classtype:web-application-activity; sid:300000059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"displayfriend.xyz",nocase; classtype:web-application-activity; sid:300000060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ditvl.com",nocase; classtype:web-application-activity; sid:300000061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dragonballclub.com",nocase; classtype:web-application-activity; sid:300000062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ehousan.top",nocase; classtype:web-application-activity; sid:300000063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eproute.info",nocase; classtype:web-application-activity; sid:300000064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eroanimeittyokusen.com",nocase; classtype:web-application-activity; sid:300000065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"erotica.live",nocase; classtype:web-application-activity; sid:300000066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"excitingthing.xyz",nocase; classtype:web-application-activity; sid:300000067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"extrasafe.xyz",nocase; classtype:web-application-activity; sid:300000068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"facebook-sex.com",nocase; classtype:web-application-activity; sid:300000069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapf.xyz",nocase; classtype:web-application-activity; sid:300000070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastplanetf.xyz",nocase; classtype:web-application-activity; sid:300000071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspotb.xyz",nocase; classtype:web-application-activity; sid:300000072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastwebe.xyz",nocase; classtype:web-application-activity; sid:300000073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmesonlineturbo.net",nocase; classtype:web-application-activity; sid:300000074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmrod.xyz",nocase; classtype:web-application-activity; sid:300000075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"films-down.com",nocase; classtype:web-application-activity; sid:300000076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"financial-deals.xyz",nocase; classtype:web-application-activity; sid:300000077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findforus.net",nocase; classtype:web-application-activity; sid:300000078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findoffers.co",nocase; classtype:web-application-activity; sid:300000079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces4download.work",nocase; classtype:web-application-activity; sid:300000080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findyourultimateplayersfirst.best",nocase; classtype:web-application-activity; sid:300000081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"firststableplayer.work",nocase; classtype:web-application-activity; sid:300000082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fisham.site",nocase; classtype:web-application-activity; sid:300000083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandready.info",nocase; classtype:web-application-activity; sid:300000084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandstable.club",nocase; classtype:web-application-activity; sid:300000085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitbodyandsoul.info",nocase; classtype:web-application-activity; sid:300000086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitcourage.info",nocase; classtype:web-application-activity; sid:300000087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspark.info",nocase; classtype:web-application-activity; sid:300000088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspot.club",nocase; classtype:web-application-activity; sid:300000089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthsure.info",nocase; classtype:web-application-activity; sid:300000090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitlifevalue.info",nocase; classtype:web-application-activity; sid:300000091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitnessdial.club",nocase; classtype:web-application-activity; sid:300000092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitsure.info",nocase; classtype:web-application-activity; sid:300000093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flatbellylife.info",nocase; classtype:web-application-activity; sid:300000094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"foregoingpump.xyz",nocase; classtype:web-application-activity; sid:300000095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"forsalecheap.net",nocase; classtype:web-application-activity; sid:300000096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrade.work",nocase; classtype:web-application-activity; sid:300000097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freshclover.info",nocase; classtype:web-application-activity; sid:300000098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fuck-me-hard.club",nocase; classtype:web-application-activity; sid:300000099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapc.xyz",nocase; classtype:web-application-activity; sid:300000100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapd.xyz",nocase; classtype:web-application-activity; sid:300000101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funplanetb.xyz",nocase; classtype:web-application-activity; sid:300000102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funsiteb.xyz",nocase; classtype:web-application-activity; sid:300000103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspinf.xyz",nocase; classtype:web-application-activity; sid:300000104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspotf.xyz",nocase; classtype:web-application-activity; sid:300000105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funwebd.xyz",nocase; classtype:web-application-activity; sid:300000106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fwsxqc.cn",nocase; classtype:web-application-activity; sid:300000107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gainhealth.info",nocase; classtype:web-application-activity; sid:300000108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gapingshame.xyz",nocase; classtype:web-application-activity; sid:300000109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"generouscare.info",nocase; classtype:web-application-activity; sid:300000110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getstablesystemupgrades.work",nocase; classtype:web-application-activity; sid:300000111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladdboulevard.xyz",nocase; classtype:web-application-activity; sid:300000113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladslotweb.xyz",nocase; classtype:web-application-activity; sid:300000115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotplay.xyz",nocase; classtype:web-application-activity; sid:300000116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotwonder.xyz",nocase; classtype:web-application-activity; sid:300000117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.fun",nocase; classtype:web-application-activity; sid:300000118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.online",nocase; classtype:web-application-activity; sid:300000119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.site",nocase; classtype:web-application-activity; sid:300000120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.surf",nocase; classtype:web-application-activity; sid:300000121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.website",nocase; classtype:web-application-activity; sid:300000122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.fun",nocase; classtype:web-application-activity; sid:300000123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.store",nocase; classtype:web-application-activity; sid:300000124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"govpshosting.com",nocase; classtype:web-application-activity; sid:300000125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"graburprize.net",nocase; classtype:web-application-activity; sid:300000126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gramp.xyz",nocase; classtype:web-application-activity; sid:300000127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"grandcasinoprize.info",nocase; classtype:web-application-activity; sid:300000128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"greatplaceofstubs.work",nocase; classtype:web-application-activity; sid:300000129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"greatsearch.xyz",nocase; classtype:web-application-activity; sid:300000130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"growthnetic.club",nocase; classtype:web-application-activity; sid:300000131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"hailso.xyz",nocase; classtype:web-application-activity; sid:300000132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"haircarepro.info",nocase; classtype:web-application-activity; sid:300000133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"happyactive.today",nocase; classtype:web-application-activity; sid:300000134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"happymakeworld.xyz",nocase; classtype:web-application-activity; sid:300000135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healandgrow.club",nocase; classtype:web-application-activity; sid:300000136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthdefine.info",nocase; classtype:web-application-activity; sid:300000137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthdome.info",nocase; classtype:web-application-activity; sid:300000138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healtheezy.info",nocase; classtype:web-application-activity; sid:300000139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthemerge.info",nocase; classtype:web-application-activity; sid:300000140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthjolly.info",nocase; classtype:web-application-activity; sid:300000141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmainly.info",nocase; classtype:web-application-activity; sid:300000142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmaintain.info",nocase; classtype:web-application-activity; sid:300000143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmama.info",nocase; classtype:web-application-activity; sid:300000144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmanic.info",nocase; classtype:web-application-activity; sid:300000145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthmarlin.club",nocase; classtype:web-application-activity; sid:300000146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthneo.club",nocase; classtype:web-application-activity; sid:300000147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthomega.club",nocase; classtype:web-application-activity; sid:300000148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthready.info",nocase; classtype:web-application-activity; sid:300000149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthreportsweb.info",nocase; classtype:web-application-activity; sid:300000150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthreward.info",nocase; classtype:web-application-activity; sid:300000151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthroll.info",nocase; classtype:web-application-activity; sid:300000152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthscale.club",nocase; classtype:web-application-activity; sid:300000153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthschedule.club",nocase; classtype:web-application-activity; sid:300000154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthspark.today",nocase; classtype:web-application-activity; sid:300000155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthsupreme.club",nocase; classtype:web-application-activity; sid:300000156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthtag.club",nocase; classtype:web-application-activity; sid:300000157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthupper.club",nocase; classtype:web-application-activity; sid:300000158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthvenue.club",nocase; classtype:web-application-activity; sid:300000159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthvibe.live",nocase; classtype:web-application-activity; sid:300000160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthwella.club",nocase; classtype:web-application-activity; sid:300000161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthy-lifestyle.club",nocase; classtype:web-application-activity; sid:300000162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthyideal.club",nocase; classtype:web-application-activity; sid:300000163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthyparker.info",nocase; classtype:web-application-activity; sid:300000164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthysure.info",nocase; classtype:web-application-activity; sid:300000165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"idtheft-alert.xyz",nocase; classtype:web-application-activity; sid:300000166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iketo.diet",nocase; classtype:web-application-activity; sid:300000167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"inappropriate.top",nocase; classtype:web-application-activity; sid:300000168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"information.casa",nocase; classtype:web-application-activity; sid:300000169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"instablog.club",nocase; classtype:web-application-activity; sid:300000170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"insuredhealth.info",nocase; classtype:web-application-activity; sid:300000171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosrecommendedvpn.com",nocase; classtype:web-application-activity; sid:300000172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"izipik.com",nocase; classtype:web-application-activity; sid:300000173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyplaceplay.xyz",nocase; classtype:web-application-activity; sid:300000174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotmap.xyz",nocase; classtype:web-application-activity; sid:300000175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotspin.xyz",nocase; classtype:web-application-activity; sid:300000176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jsrenthouse.com",nocase; classtype:web-application-activity; sid:300000177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jubilantdstreet.xyz",nocase; classtype:web-application-activity; sid:300000178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"kad3md.cn",nocase; classtype:web-application-activity; sid:300000179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"keepithealthy.info",nocase; classtype:web-application-activity; sid:300000180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ketodietrecipes.org",nocase; classtype:web-application-activity; sid:300000181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"leeching.net",nocase; classtype:web-application-activity; sid:300000182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrading.info",nocase; classtype:web-application-activity; sid:300000185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplayerupdates.work",nocase; classtype:web-application-activity; sid:300000186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendarysiteupgrading.work",nocase; classtype:web-application-activity; sid:300000187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrade.info",nocase; classtype:web-application-activity; sid:300000188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"life-esteem.info",nocase; classtype:web-application-activity; sid:300000191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lifecaregoal.info",nocase; classtype:web-application-activity; sid:300000192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lightstop.xyz",nocase; classtype:web-application-activity; sid:300000193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livehealthcare.today",nocase; classtype:web-application-activity; sid:300000194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livelyyroad.xyz",nocase; classtype:web-application-activity; sid:300000195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livingmighty.club",nocase; classtype:web-application-activity; sid:300000196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadfree-bestheavilyfile.best",nocase; classtype:web-application-activity; sid:300000197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadheavily-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loosefit.info",nocase; classtype:web-application-activity; sid:300000201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loveorfun.cc",nocase; classtype:web-application-activity; sid:300000202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckjackcasino.info",nocase; classtype:web-application-activity; sid:300000203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckymedia.fun",nocase; classtype:web-application-activity; sid:300000204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"luckymedia.space",nocase; classtype:web-application-activity; sid:300000205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"madpandatv.net",nocase; classtype:web-application-activity; sid:300000206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"majorhealthpro.info",nocase; classtype:web-application-activity; sid:300000207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"makemesafeios.com",nocase; classtype:web-application-activity; sid:300000208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"managestrong-theuberfile.best",nocase; classtype:web-application-activity; sid:300000209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-therecentfile.best",nocase; classtype:web-application-activity; sid:300000211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"manageuber-theswiftfile.best",nocase; classtype:web-application-activity; sid:300000213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mathison.io",nocase; classtype:web-application-activity; sid:300000214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"max-care.info",nocase; classtype:web-application-activity; sid:300000215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mediaplayer24.ml",nocase; classtype:web-application-activity; sid:300000216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medicomatic.info",nocase; classtype:web-application-activity; sid:300000217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medjournalketo.info",nocase; classtype:web-application-activity; sid:300000218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"medsjournal.info",nocase; classtype:web-application-activity; sid:300000219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"meeryslotspin.xyz",nocase; classtype:web-application-activity; sid:300000220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"merryplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"merryplayworld.xyz",nocase; classtype:web-application-activity; sid:300000222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mindbank.ai",nocase; classtype:web-application-activity; sid:300000223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mindmatch.ai",nocase; classtype:web-application-activity; sid:300000224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"mistraffic.me",nocase; classtype:web-application-activity; sid:300000225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"modern-security.xyz",nocase; classtype:web-application-activity; sid:300000226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"monitoring-credit.xyz",nocase; classtype:web-application-activity; sid:300000227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"multitax.xyz",nocase; classtype:web-application-activity; sid:300000228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"newsitedowloads.site",nocase; classtype:web-application-activity; sid:300000229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nogfw.pro",nocase; classtype:web-application-activity; sid:300000230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nosyknot.xyz",nocase; classtype:web-application-activity; sid:300000231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"nutrinamic.info",nocase; classtype:web-application-activity; sid:300000232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"onegowc.pw",nocase; classtype:web-application-activity; sid:300000233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"onlinecinema.eu",nocase; classtype:web-application-activity; sid:300000234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatecompletely-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatecompletely-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateextremely-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateextremely-therenewedfile.best",nocase; classtype:web-application-activity; sid:300000238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatefree-theuberfile.best",nocase; classtype:web-application-activity; sid:300000239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operategreatly-therefinedfile.best",nocase; classtype:web-application-activity; sid:300000240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operategreatly-theswiftfile.best",nocase; classtype:web-application-activity; sid:300000241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatehighly-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatehighly-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateintensely-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateintensely-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatenewest-theuberfile.best",nocase; classtype:web-application-activity; sid:300000246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoriginal-themostfile.best",nocase; classtype:web-application-activity; sid:300000247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoriginal-theuberfile.best",nocase; classtype:web-application-activity; sid:300000248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateoverly-thesophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateprecise-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateprogressive-theintenselyfile.best",nocase; classtype:web-application-activity; sid:300000251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatequick-themostfile.best",nocase; classtype:web-application-activity; sid:300000252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operaterefined-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operaterenewed-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatesophisticated-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operatespeedy-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateuber-thefreefile.best",nocase; classtype:web-application-activity; sid:300000257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"operateuber-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"patriothealth.today",nocase; classtype:web-application-activity; sid:300000259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"pcicompliancemanager.xyz",nocase; classtype:web-application-activity; sid:300000260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"perfectplaceonnetforplayers.work",nocase; classtype:web-application-activity; sid:300000261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performcompletely-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performcompletely-thequickfile.best",nocase; classtype:web-application-activity; sid:300000263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performextremely-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performfree-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performgreatly-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performheavily-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-thefreefile.best",nocase; classtype:web-application-activity; sid:300000268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-theprecisefile.best",nocase; classtype:web-application-activity; sid:300000269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performhighly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performintensely-thedevelopedfile.best",nocase; classtype:web-application-activity; sid:300000271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performlatest-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performmost-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performmost-therecentfile.best",nocase; classtype:web-application-activity; sid:300000274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoriginal-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoriginal-theuberfile.best",nocase; classtype:web-application-activity; sid:300000276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performoverly-theprogressivefile.best",nocase; classtype:web-application-activity; sid:300000277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprecise-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprecise-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprogressive-theintenselyfile.best",nocase; classtype:web-application-activity; sid:300000280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performprogressive-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performquick-thecompletelyfile.best",nocase; classtype:web-application-activity; sid:300000282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrecent-themostfile.best",nocase; classtype:web-application-activity; sid:300000283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrefined-theextremelyfile.best",nocase; classtype:web-application-activity; sid:300000284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performrenewed-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performsophisticated-thehighlyfile.best",nocase; classtype:web-application-activity; sid:300000286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performspeedy-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performuber-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"performuber-therenewedfile.best",nocase; classtype:web-application-activity; sid:300000289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"piorkeepi.top",nocase; classtype:web-application-activity; sid:300000290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"placesiteb.xyz",nocase; classtype:web-application-activity; sid:300000291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"placesitee.xyz",nocase; classtype:web-application-activity; sid:300000292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"placewebe.xyz",nocase; classtype:web-application-activity; sid:300000293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"plampo.xyz",nocase; classtype:web-application-activity; sid:300000294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspina.xyz",nocase; classtype:web-application-activity; sid:300000295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspind.xyz",nocase; classtype:web-application-activity; sid:300000296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"playspote.xyz",nocase; classtype:web-application-activity; sid:300000297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"premiernursingacademy.org",nocase; classtype:web-application-activity; sid:300000298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"preparedforsafeupgrading.work",nocase; classtype:web-application-activity; sid:300000299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primawise.info",nocase; classtype:web-application-activity; sid:300000300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primecare.today",nocase; classtype:web-application-activity; sid:300000301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"productiq.net",nocase; classtype:web-application-activity; sid:300000302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"prohealthroutine.info",nocase; classtype:web-application-activity; sid:300000303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protect-connection.com",nocase; classtype:web-application-activity; sid:300000304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protectyourvpn.com",nocase; classtype:web-application-activity; sid:300000305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"readyhealth.info",nocase; classtype:web-application-activity; sid:300000306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"readyhealthgo.today",nocase; classtype:web-application-activity; sid:300000307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.casa",nocase; classtype:web-application-activity; sid:300000308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.cyou",nocase; classtype:web-application-activity; sid:300000309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.fun",nocase; classtype:web-application-activity; sid:300000310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.site",nocase; classtype:web-application-activity; sid:300000311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.space",nocase; classtype:web-application-activity; sid:300000312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.surf",nocase; classtype:web-application-activity; sid:300000313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"recontent.website",nocase; classtype:web-application-activity; sid:300000314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"reliablesoftwarevideos.info",nocase; classtype:web-application-activity; sid:300000315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"remedify.info",nocase; classtype:web-application-activity; sid:300000316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.casa",nocase; classtype:web-application-activity; sid:300000317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.fun",nocase; classtype:web-application-activity; sid:300000318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.online",nocase; classtype:web-application-activity; sid:300000319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.site",nocase; classtype:web-application-activity; sid:300000320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"renewvideo.website",nocase; classtype:web-application-activity; sid:300000321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"resignation.top",nocase; classtype:web-application-activity; sid:300000322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"roadtoyourhealth.info",nocase; classtype:web-application-activity; sid:300000323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"robogarden.io",nocase; classtype:web-application-activity; sid:300000324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rootessential.info",nocase; classtype:web-application-activity; sid:300000325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rotharbor.xyz",nocase; classtype:web-application-activity; sid:300000326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runadvanced-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runcurrent-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rundeveloped-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestcurrentfile.best",nocase; classtype:web-application-activity; sid:300000331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runextremely-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runfree-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runintensely-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runlatest-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runnewest-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoriginal-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoriginal-bestintenselyfile.best",nocase; classtype:web-application-activity; sid:300000339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestdevelopedfile.best",nocase; classtype:web-application-activity; sid:300000340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runoverly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runrecent-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"runrecent-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safelyonline.tech",nocase; classtype:web-application-activity; sid:300000345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safest4placeupdate.info",nocase; classtype:web-application-activity; sid:300000346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"safest4placeupdates.info",nocase; classtype:web-application-activity; sid:300000347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"scheduleagreement.xyz",nocase; classtype:web-application-activity; sid:300000348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"score-monitoring.xyz",nocase; classtype:web-application-activity; sid:300000349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"search-tool.net",nocase; classtype:web-application-activity; sid:300000350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"search-trends.co",nocase; classtype:web-application-activity; sid:300000351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"searchfeed.co",nocase; classtype:web-application-activity; sid:300000352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-alert.xyz",nocase; classtype:web-application-activity; sid:300000353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-alerts.xyz",nocase; classtype:web-application-activity; sid:300000354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sec-monitoring.xyz",nocase; classtype:web-application-activity; sid:300000355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"second-handjam.xyz",nocase; classtype:web-application-activity; sid:300000356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-made-easy.xyz",nocase; classtype:web-application-activity; sid:300000357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-pro.xyz",nocase; classtype:web-application-activity; sid:300000358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"security-protection.xyz",nocase; classtype:web-application-activity; sid:300000359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"seemlast.monster",nocase; classtype:web-application-activity; sid:300000360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"selfradiance.info",nocase; classtype:web-application-activity; sid:300000361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shkshk.site",nocase; classtype:web-application-activity; sid:300000362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shopnsave.world",nocase; classtype:web-application-activity; sid:300000363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shoppingexp.xyz",nocase; classtype:web-application-activity; sid:300000364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"smartys.link",nocase; classtype:web-application-activity; sid:300000365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetd.xyz",nocase; classtype:web-application-activity; sid:300000366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspinb.xyz",nocase; classtype:web-application-activity; sid:300000367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspotf.xyz",nocase; classtype:web-application-activity; sid:300000368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetb.xyz",nocase; classtype:web-application-activity; sid:300000369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitea.xyz",nocase; classtype:web-application-activity; sid:300000370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitef.xyz",nocase; classtype:web-application-activity; sid:300000371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stingyscent.xyz",nocase; classtype:web-application-activity; sid:300000372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thefreefile.best",nocase; classtype:web-application-activity; sid:300000373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thequickfile.best",nocase; classtype:web-application-activity; sid:300000374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storelatest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storenewest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-theadvancedfile.best",nocase; classtype:web-application-activity; sid:300000379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storerecent-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storespeedy-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeswift-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"styleandhealth.info",nocase; classtype:web-application-activity; sid:300000386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"subeamy.pw",nocase; classtype:web-application-activity; sid:300000387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sugar-legal-about13.fun",nocase; classtype:web-application-activity; sid:300000388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superiorcare.info",nocase; classtype:web-application-activity; sid:300000389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-club.club",nocase; classtype:web-application-activity; sid:300000390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-review.club",nocase; classtype:web-application-activity; sid:300000391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncgreatly-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncheavily-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncintensely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synclatest-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncoriginal-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncrenewed-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tackis.xyz",nocase; classtype:web-application-activity; sid:300000410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"talskingest.top",nocase; classtype:web-application-activity; sid:300000411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tastefulwood.xyz",nocase; classtype:web-application-activity; sid:300000412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theable.me",nocase; classtype:web-application-activity; sid:300000413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theconnectvpn.com",nocase; classtype:web-application-activity; sid:300000416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thecryptomoney.info",nocase; classtype:web-application-activity; sid:300000417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefatburner.info",nocase; classtype:web-application-activity; sid:300000418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefitproject.club",nocase; classtype:web-application-activity; sid:300000419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcurve.info",nocase; classtype:web-application-activity; sid:300000420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcycle.club",nocase; classtype:web-application-activity; sid:300000421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthgo.info",nocase; classtype:web-application-activity; sid:300000422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthpedia.info",nocase; classtype:web-application-activity; sid:300000423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthystyle.info",nocase; classtype:web-application-activity; sid:300000424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthyvibe.info",nocase; classtype:web-application-activity; sid:300000425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehotshot.info",nocase; classtype:web-application-activity; sid:300000426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thenewjourney.info",nocase; classtype:web-application-activity; sid:300000427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thepackage.club",nocase; classtype:web-application-activity; sid:300000428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestplayerlinks.work",nocase; classtype:web-application-activity; sid:300000429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theslotomania.info",nocase; classtype:web-application-activity; sid:300000430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablealwayssafeupdates.work",nocase; classtype:web-application-activity; sid:300000431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupgrades.best",nocase; classtype:web-application-activity; sid:300000433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thrillqueen.xyz",nocase; classtype:web-application-activity; sid:300000434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"toovolution.club",nocase; classtype:web-application-activity; sid:300000435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"topnotchsports.tips",nocase; classtype:web-application-activity; sid:300000436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficbounce.net",nocase; classtype:web-application-activity; sid:300000437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficgate.cc",nocase; classtype:web-application-activity; sid:300000438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trkvpn.xyz",nocase; classtype:web-application-activity; sid:300000439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uclaimrewards.net",nocase; classtype:web-application-activity; sid:300000440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unequalfaucet.xyz",nocase; classtype:web-application-activity; sid:300000441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uniremedy.info",nocase; classtype:web-application-activity; sid:300000442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmstreet.xyz",nocase; classtype:web-application-activity; sid:300000444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmway.xyz",nocase; classtype:web-application-activity; sid:300000445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatecurrent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatelatest-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updaterecent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upmakesite.xyz",nocase; classtype:web-application-activity; sid:300000452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vexearth.xyz",nocase; classtype:web-application-activity; sid:300000454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viral-surveys.win",nocase; classtype:web-application-activity; sid:300000455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viralarticles.net",nocase; classtype:web-application-activity; sid:300000456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vital-health.club",nocase; classtype:web-application-activity; sid:300000457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vitalrole.info",nocase; classtype:web-application-activity; sid:300000458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn-pro.info",nocase; classtype:web-application-activity; sid:300000459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnadefenceplus.com",nocase; classtype:web-application-activity; sid:300000460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpntool.me",nocase; classtype:web-application-activity; sid:300000461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"website4all.info",nocase; classtype:web-application-activity; sid:300000462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websiteforall.work",nocase; classtype:web-application-activity; sid:300000463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websitetoget.work",nocase; classtype:web-application-activity; sid:300000464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"webtip.co",nocase; classtype:web-application-activity; sid:300000465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessgram.info",nocase; classtype:web-application-activity; sid:300000466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessplum.info",nocase; classtype:web-application-activity; sid:300000467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wherentlybrane.site",nocase; classtype:web-application-activity; sid:300000468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wowlifestyle.info",nocase; classtype:web-application-activity; sid:300000469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnection.info",nocase; classtype:web-application-activity; sid:300000473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnections.info",nocase; classtype:web-application-activity; sid:300000474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdate.work",nocase; classtype:web-application-activity; sid:300000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdating.work",nocase; classtype:web-application-activity; sid:300000480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestplayerlink.best",nocase; classtype:web-application-activity; sid:300000483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelink.info",nocase; classtype:web-application-activity; sid:300000485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelinks.info",nocase; classtype:web-application-activity; sid:300000486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafesystemsupdating.work",nocase; classtype:web-application-activity; sid:300000487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourultimateperfectupgrades.work",nocase; classtype:web-application-activity; sid:300000488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ysfetinora.tk",nocase; classtype:web-application-activity; sid:300000489; rev:1;) diff --git a/dist/pup-filter-suricata.rules b/dist/pup-filter-suricata.rules index 1de143f..2090da6 100644 --- a/dist/pup-filter-suricata.rules +++ b/dist/pup-filter-suricata.rules @@ -1,6 +1,6 @@ # Title: PUP Domains Suricata Ruleset # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,479 +8,489 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123news.website"; classtype:web-application-activity; sid:300000001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"20patogh.com"; classtype:web-application-activity; sid:300000002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"321movies.xyz"; classtype:web-application-activity; sid:300000003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"4uabs.club"; classtype:web-application-activity; sid:300000004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"7awwa2.xyz"; classtype:web-application-activity; sid:300000005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"7awwa2.xyz"; classtype:web-application-activity; sid:300000004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abcscience.xyz"; classtype:web-application-activity; sid:300000005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abeah-security.xyz"; classtype:web-application-activity; sid:300000006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adrondespi.top"; classtype:web-application-activity; sid:300000007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"advancecare.info"; classtype:web-application-activity; sid:300000008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"akb48wrapup.com"; classtype:web-application-activity; sid:300000009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amateurxporn.com"; classtype:web-application-activity; sid:300000010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apptool.me"; classtype:web-application-activity; sid:300000011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ashtdi.cn"; classtype:web-application-activity; sid:300000012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"assuredhealth.info"; classtype:web-application-activity; sid:300000013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"asufij.xyz"; classtype:web-application-activity; sid:300000014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"auto-lawyer.site"; classtype:web-application-activity; sid:300000015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"baseofmp3.com"; classtype:web-application-activity; sid:300000016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrade.info"; classtype:web-application-activity; sid:300000017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrades.info"; classtype:web-application-activity; sid:300000018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrading.info"; classtype:web-application-activity; sid:300000019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestresults.xyz"; classtype:web-application-activity; sid:300000020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayer.info"; classtype:web-application-activity; sid:300000021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayers.info"; classtype:web-application-activity; sid:300000022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayer.info"; classtype:web-application-activity; sid:300000023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayers.info"; classtype:web-application-activity; sid:300000024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigcbd.info"; classtype:web-application-activity; sid:300000025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigdaycasino.info"; classtype:web-application-activity; sid:300000026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoin-trader.me"; classtype:web-application-activity; sid:300000027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bittrend.com"; classtype:web-application-activity; sid:300000028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biztherapy.info"; classtype:web-application-activity; sid:300000029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyamaze.club"; classtype:web-application-activity; sid:300000030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyselfcare.info"; classtype:web-application-activity; sid:300000031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browsercheck.site"; classtype:web-application-activity; sid:300000032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bulley.shop"; classtype:web-application-activity; sid:300000033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cabins-r-us.com"; classtype:web-application-activity; sid:300000034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calculateprint.xyz"; classtype:web-application-activity; sid:300000035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"care-connection.info"; classtype:web-application-activity; sid:300000036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carebility.info"; classtype:web-application-activity; sid:300000037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carevision.info"; classtype:web-application-activity; sid:300000038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"celebseven.com"; classtype:web-application-activity; sid:300000039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"centrodeartigos.com"; classtype:web-application-activity; sid:300000040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cheerplaceweb.xyz"; classtype:web-application-activity; sid:300000041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coachbelief.xyz"; classtype:web-application-activity; sid:300000042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"collectrewards.net"; classtype:web-application-activity; sid:300000043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"comphp.xyz"; classtype:web-application-activity; sid:300000044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceivecolor.xyz"; classtype:web-application-activity; sid:300000045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conflaqpzc.info"; classtype:web-application-activity; sid:300000046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cooing.top"; classtype:web-application-activity; sid:300000047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-alerts.xyz"; classtype:web-application-activity; sid:300000048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-monitor.xyz"; classtype:web-application-activity; sid:300000049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-resources.xyz"; classtype:web-application-activity; sid:300000050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotradingcourses.net"; classtype:web-application-activity; sid:300000051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptounlimited.info"; classtype:web-application-activity; sid:300000052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cs-alerts.xyz"; classtype:web-application-activity; sid:300000053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cselfconnect.com"; classtype:web-application-activity; sid:300000054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curesector.today"; classtype:web-application-activity; sid:300000055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"degreenm.top"; classtype:web-application-activity; sid:300000056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"delightcmain.xyz"; classtype:web-application-activity; sid:300000057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digitalinvest.news"; classtype:web-application-activity; sid:300000058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"displayfriend.xyz"; classtype:web-application-activity; sid:300000059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ditvl.com"; classtype:web-application-activity; sid:300000060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonballclub.com"; classtype:web-application-activity; sid:300000061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ehousan.top"; classtype:web-application-activity; sid:300000062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eproute.info"; classtype:web-application-activity; sid:300000063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eroanimeittyokusen.com"; classtype:web-application-activity; sid:300000064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erotica.live"; classtype:web-application-activity; sid:300000065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"excitingthing.xyz"; classtype:web-application-activity; sid:300000066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrasafe.xyz"; classtype:web-application-activity; sid:300000067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"facebook-sex.com"; classtype:web-application-activity; sid:300000068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapf.xyz"; classtype:web-application-activity; sid:300000069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastplanetf.xyz"; classtype:web-application-activity; sid:300000070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspotb.xyz"; classtype:web-application-activity; sid:300000071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastwebe.xyz"; classtype:web-application-activity; sid:300000072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmesonlineturbo.net"; classtype:web-application-activity; sid:300000073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmrod.xyz"; classtype:web-application-activity; sid:300000074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"films-down.com"; classtype:web-application-activity; sid:300000075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"financial-deals.xyz"; classtype:web-application-activity; sid:300000076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findoffers.co"; classtype:web-application-activity; sid:300000077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces4download.work"; classtype:web-application-activity; sid:300000078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findyourultimateplayersfirst.best"; classtype:web-application-activity; sid:300000079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"firststableplayer.work"; classtype:web-application-activity; sid:300000080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisham.site"; classtype:web-application-activity; sid:300000081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandready.info"; classtype:web-application-activity; sid:300000082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandstable.club"; classtype:web-application-activity; sid:300000083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitbodyandsoul.info"; classtype:web-application-activity; sid:300000084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitcourage.info"; classtype:web-application-activity; sid:300000085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspark.info"; classtype:web-application-activity; sid:300000086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspot.club"; classtype:web-application-activity; sid:300000087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthsure.info"; classtype:web-application-activity; sid:300000088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitlifevalue.info"; classtype:web-application-activity; sid:300000089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitnessdial.club"; classtype:web-application-activity; sid:300000090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitsure.info"; classtype:web-application-activity; sid:300000091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flatbellylife.info"; classtype:web-application-activity; sid:300000092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foregoingpump.xyz"; classtype:web-application-activity; sid:300000093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forsalecheap.net"; classtype:web-application-activity; sid:300000094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrade.work"; classtype:web-application-activity; sid:300000095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freshclover.info"; classtype:web-application-activity; sid:300000096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fuck-me-hard.club"; classtype:web-application-activity; sid:300000097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapc.xyz"; classtype:web-application-activity; sid:300000098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapd.xyz"; classtype:web-application-activity; sid:300000099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funplanetb.xyz"; classtype:web-application-activity; sid:300000100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funsiteb.xyz"; classtype:web-application-activity; sid:300000101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspinf.xyz"; classtype:web-application-activity; sid:300000102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspotf.xyz"; classtype:web-application-activity; sid:300000103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funwebd.xyz"; classtype:web-application-activity; sid:300000104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fwsxqc.cn"; classtype:web-application-activity; sid:300000105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gainhealth.info"; classtype:web-application-activity; sid:300000106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gapingshame.xyz"; classtype:web-application-activity; sid:300000107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generouscare.info"; classtype:web-application-activity; sid:300000108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getstablesystemupgrades.work"; classtype:web-application-activity; sid:300000109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladcboulevard.xyz"; classtype:web-application-activity; sid:300000110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladdboulevard.xyz"; classtype:web-application-activity; sid:300000111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladplaceweb.xyz"; classtype:web-application-activity; sid:300000112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladslotweb.xyz"; classtype:web-application-activity; sid:300000113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotplay.xyz"; classtype:web-application-activity; sid:300000114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotwonder.xyz"; classtype:web-application-activity; sid:300000115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.fun"; classtype:web-application-activity; sid:300000116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.online"; classtype:web-application-activity; sid:300000117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.site"; classtype:web-application-activity; sid:300000118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.surf"; classtype:web-application-activity; sid:300000119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.website"; classtype:web-application-activity; sid:300000120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.fun"; classtype:web-application-activity; sid:300000121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.store"; classtype:web-application-activity; sid:300000122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"govpshosting.com"; classtype:web-application-activity; sid:300000123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"graburprize.net"; classtype:web-application-activity; sid:300000124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gramp.xyz"; classtype:web-application-activity; sid:300000125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"grandcasinoprize.info"; classtype:web-application-activity; sid:300000126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"greatplaceofstubs.work"; classtype:web-application-activity; sid:300000127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"growthnetic.club"; classtype:web-application-activity; sid:300000128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hailso.xyz"; classtype:web-application-activity; sid:300000129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"haircarepro.info"; classtype:web-application-activity; sid:300000130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"happyactive.today"; classtype:web-application-activity; sid:300000131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"happymakeworld.xyz"; classtype:web-application-activity; sid:300000132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthdefine.info"; classtype:web-application-activity; sid:300000133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthdome.info"; classtype:web-application-activity; sid:300000134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healtheezy.info"; classtype:web-application-activity; sid:300000135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthemerge.info"; classtype:web-application-activity; sid:300000136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthjolly.info"; classtype:web-application-activity; sid:300000137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmainly.info"; classtype:web-application-activity; sid:300000138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmaintain.info"; classtype:web-application-activity; sid:300000139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmama.info"; classtype:web-application-activity; sid:300000140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmanic.info"; classtype:web-application-activity; sid:300000141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmarlin.club"; classtype:web-application-activity; sid:300000142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthneo.club"; classtype:web-application-activity; sid:300000143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthomega.club"; classtype:web-application-activity; sid:300000144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthready.info"; classtype:web-application-activity; sid:300000145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthreportsweb.info"; classtype:web-application-activity; sid:300000146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthreward.info"; classtype:web-application-activity; sid:300000147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthroll.info"; classtype:web-application-activity; sid:300000148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthscale.club"; classtype:web-application-activity; sid:300000149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthschedule.club"; classtype:web-application-activity; sid:300000150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthspark.today"; classtype:web-application-activity; sid:300000151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthsupreme.club"; classtype:web-application-activity; sid:300000152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthtag.club"; classtype:web-application-activity; sid:300000153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthupper.club"; classtype:web-application-activity; sid:300000154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthvenue.club"; classtype:web-application-activity; sid:300000155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthvibe.live"; classtype:web-application-activity; sid:300000156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthwella.club"; classtype:web-application-activity; sid:300000157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthy-lifestyle.club"; classtype:web-application-activity; sid:300000158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthyideal.club"; classtype:web-application-activity; sid:300000159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthyparker.info"; classtype:web-application-activity; sid:300000160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthysure.info"; classtype:web-application-activity; sid:300000161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idtheft-alert.xyz"; classtype:web-application-activity; sid:300000162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iketo.diet"; classtype:web-application-activity; sid:300000163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inappropriate.top"; classtype:web-application-activity; sid:300000164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"information.casa"; classtype:web-application-activity; sid:300000165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instablog.club"; classtype:web-application-activity; sid:300000166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"insuredhealth.info"; classtype:web-application-activity; sid:300000167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosrecommendedvpn.com"; classtype:web-application-activity; sid:300000168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"izipik.com"; classtype:web-application-activity; sid:300000169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyplaceplay.xyz"; classtype:web-application-activity; sid:300000170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotmap.xyz"; classtype:web-application-activity; sid:300000171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotspin.xyz"; classtype:web-application-activity; sid:300000172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jsrenthouse.com"; classtype:web-application-activity; sid:300000173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jubilantdstreet.xyz"; classtype:web-application-activity; sid:300000174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kad3md.cn"; classtype:web-application-activity; sid:300000175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keepithealthy.info"; classtype:web-application-activity; sid:300000176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketodietrecipes.org"; classtype:web-application-activity; sid:300000177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leeching.net"; classtype:web-application-activity; sid:300000178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrading.info"; classtype:web-application-activity; sid:300000181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplayerupdates.work"; classtype:web-application-activity; sid:300000182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendarysiteupgrading.work"; classtype:web-application-activity; sid:300000183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrade.info"; classtype:web-application-activity; sid:300000184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"life-esteem.info"; classtype:web-application-activity; sid:300000187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifecaregoal.info"; classtype:web-application-activity; sid:300000188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lightstop.xyz"; classtype:web-application-activity; sid:300000189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livehealthcare.today"; classtype:web-application-activity; sid:300000190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livelyyroad.xyz"; classtype:web-application-activity; sid:300000191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livingmighty.club"; classtype:web-application-activity; sid:300000192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadfree-bestheavilyfile.best"; classtype:web-application-activity; sid:300000193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestadvancedfile.best"; classtype:web-application-activity; sid:300000194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestquickfile.best"; classtype:web-application-activity; sid:300000195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadheavily-bestfreefile.best"; classtype:web-application-activity; sid:300000196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loosefit.info"; classtype:web-application-activity; sid:300000197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loveorfun.cc"; classtype:web-application-activity; sid:300000198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckjackcasino.info"; classtype:web-application-activity; sid:300000199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckymedia.fun"; classtype:web-application-activity; sid:300000200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckymedia.space"; classtype:web-application-activity; sid:300000201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"madpandatv.net"; classtype:web-application-activity; sid:300000202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"majorhealthpro.info"; classtype:web-application-activity; sid:300000203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"makemesafeios.com"; classtype:web-application-activity; sid:300000204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managestrong-theuberfile.best"; classtype:web-application-activity; sid:300000205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-thenewestfile.best"; classtype:web-application-activity; sid:300000206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-therecentfile.best"; classtype:web-application-activity; sid:300000207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-thestrongfile.best"; classtype:web-application-activity; sid:300000208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-theswiftfile.best"; classtype:web-application-activity; sid:300000209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mathison.io"; classtype:web-application-activity; sid:300000210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"max-care.info"; classtype:web-application-activity; sid:300000211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mediaplayer24.ml"; classtype:web-application-activity; sid:300000212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medicomatic.info"; classtype:web-application-activity; sid:300000213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medjournalketo.info"; classtype:web-application-activity; sid:300000214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medsjournal.info"; classtype:web-application-activity; sid:300000215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meeryslotspin.xyz"; classtype:web-application-activity; sid:300000216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merryplayglobal.xyz"; classtype:web-application-activity; sid:300000217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merryplayworld.xyz"; classtype:web-application-activity; sid:300000218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mindmatch.ai"; classtype:web-application-activity; sid:300000219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mistraffic.me"; classtype:web-application-activity; sid:300000220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modern-security.xyz"; classtype:web-application-activity; sid:300000221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"monitoring-credit.xyz"; classtype:web-application-activity; sid:300000222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"multitax.xyz"; classtype:web-application-activity; sid:300000223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"newsitedowloads.site"; classtype:web-application-activity; sid:300000224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nogfw.pro"; classtype:web-application-activity; sid:300000225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nosyknot.xyz"; classtype:web-application-activity; sid:300000226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nutrinamic.info"; classtype:web-application-activity; sid:300000227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onegowc.pw"; classtype:web-application-activity; sid:300000228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatecompletely-theprecisefile.best"; classtype:web-application-activity; sid:300000229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatecompletely-thespeedyfile.best"; classtype:web-application-activity; sid:300000230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateextremely-theprogressivefile.best"; classtype:web-application-activity; sid:300000231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateextremely-therenewedfile.best"; classtype:web-application-activity; sid:300000232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatefree-theuberfile.best"; classtype:web-application-activity; sid:300000233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operategreatly-therefinedfile.best"; classtype:web-application-activity; sid:300000234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operategreatly-theswiftfile.best"; classtype:web-application-activity; sid:300000235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatehighly-thespeedyfile.best"; classtype:web-application-activity; sid:300000236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatehighly-thestrongfile.best"; classtype:web-application-activity; sid:300000237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateintensely-theprogressivefile.best"; classtype:web-application-activity; sid:300000238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateintensely-thestrongfile.best"; classtype:web-application-activity; sid:300000239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatenewest-theuberfile.best"; classtype:web-application-activity; sid:300000240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoriginal-themostfile.best"; classtype:web-application-activity; sid:300000241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoriginal-theuberfile.best"; classtype:web-application-activity; sid:300000242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoverly-thesophisticatedfile.best"; classtype:web-application-activity; sid:300000243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateprecise-thecompletelyfile.best"; classtype:web-application-activity; sid:300000244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateprogressive-theintenselyfile.best"; classtype:web-application-activity; sid:300000245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatequick-themostfile.best"; classtype:web-application-activity; sid:300000246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operaterefined-thegreatlyfile.best"; classtype:web-application-activity; sid:300000247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operaterenewed-theextremelyfile.best"; classtype:web-application-activity; sid:300000248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatesophisticated-theoverlyfile.best"; classtype:web-application-activity; sid:300000249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatespeedy-thehighlyfile.best"; classtype:web-application-activity; sid:300000250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateuber-thefreefile.best"; classtype:web-application-activity; sid:300000251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateuber-theoriginalfile.best"; classtype:web-application-activity; sid:300000252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patriothealth.today"; classtype:web-application-activity; sid:300000253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pcicompliancemanager.xyz"; classtype:web-application-activity; sid:300000254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perfectplaceonnetforplayers.work"; classtype:web-application-activity; sid:300000255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performcompletely-thelatestfile.best"; classtype:web-application-activity; sid:300000256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performcompletely-thequickfile.best"; classtype:web-application-activity; sid:300000257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performextremely-theprecisefile.best"; classtype:web-application-activity; sid:300000258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performfree-thehighlyfile.best"; classtype:web-application-activity; sid:300000259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performgreatly-thespeedyfile.best"; classtype:web-application-activity; sid:300000260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performheavily-theoriginalfile.best"; classtype:web-application-activity; sid:300000261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-thefreefile.best"; classtype:web-application-activity; sid:300000262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-theprecisefile.best"; classtype:web-application-activity; sid:300000263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-therecentfile.best"; classtype:web-application-activity; sid:300000264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performintensely-thedevelopedfile.best"; classtype:web-application-activity; sid:300000265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performlatest-thecompletelyfile.best"; classtype:web-application-activity; sid:300000266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performmost-thenewestfile.best"; classtype:web-application-activity; sid:300000267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performmost-therecentfile.best"; classtype:web-application-activity; sid:300000268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoriginal-theheavilyfile.best"; classtype:web-application-activity; sid:300000269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoriginal-theuberfile.best"; classtype:web-application-activity; sid:300000270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoverly-theprogressivefile.best"; classtype:web-application-activity; sid:300000271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprecise-theextremelyfile.best"; classtype:web-application-activity; sid:300000272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprecise-thehighlyfile.best"; classtype:web-application-activity; sid:300000273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprogressive-theintenselyfile.best"; classtype:web-application-activity; sid:300000274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprogressive-theoverlyfile.best"; classtype:web-application-activity; sid:300000275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performquick-thecompletelyfile.best"; classtype:web-application-activity; sid:300000276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrecent-themostfile.best"; classtype:web-application-activity; sid:300000277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrefined-theextremelyfile.best"; classtype:web-application-activity; sid:300000278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrenewed-theoverlyfile.best"; classtype:web-application-activity; sid:300000279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performsophisticated-thehighlyfile.best"; classtype:web-application-activity; sid:300000280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performspeedy-thegreatlyfile.best"; classtype:web-application-activity; sid:300000281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performuber-theoriginalfile.best"; classtype:web-application-activity; sid:300000282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performuber-therenewedfile.best"; classtype:web-application-activity; sid:300000283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"piorkeepi.top"; classtype:web-application-activity; sid:300000284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"placesitee.xyz"; classtype:web-application-activity; sid:300000285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"placewebe.xyz"; classtype:web-application-activity; sid:300000286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"plampo.xyz"; classtype:web-application-activity; sid:300000287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspina.xyz"; classtype:web-application-activity; sid:300000288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspind.xyz"; classtype:web-application-activity; sid:300000289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspote.xyz"; classtype:web-application-activity; sid:300000290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"premiernursingacademy.org"; classtype:web-application-activity; sid:300000291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"preparedforsafeupgrading.work"; classtype:web-application-activity; sid:300000292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primawise.info"; classtype:web-application-activity; sid:300000293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primecare.today"; classtype:web-application-activity; sid:300000294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prohealthroutine.info"; classtype:web-application-activity; sid:300000295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protect-connection.com"; classtype:web-application-activity; sid:300000296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protectyourvpn.com"; classtype:web-application-activity; sid:300000297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readyhealth.info"; classtype:web-application-activity; sid:300000298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readyhealthgo.today"; classtype:web-application-activity; sid:300000299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.casa"; classtype:web-application-activity; sid:300000300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.cyou"; classtype:web-application-activity; sid:300000301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.fun"; classtype:web-application-activity; sid:300000302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.site"; classtype:web-application-activity; sid:300000303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.space"; classtype:web-application-activity; sid:300000304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.surf"; classtype:web-application-activity; sid:300000305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.website"; classtype:web-application-activity; sid:300000306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"reliablesoftwarevideos.info"; classtype:web-application-activity; sid:300000307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"remedify.info"; classtype:web-application-activity; sid:300000308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.casa"; classtype:web-application-activity; sid:300000309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.fun"; classtype:web-application-activity; sid:300000310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.online"; classtype:web-application-activity; sid:300000311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.site"; classtype:web-application-activity; sid:300000312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.website"; classtype:web-application-activity; sid:300000313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"resignation.top"; classtype:web-application-activity; sid:300000314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"roadtoyourhealth.info"; classtype:web-application-activity; sid:300000315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"robogarden.io"; classtype:web-application-activity; sid:300000316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rootessential.info"; classtype:web-application-activity; sid:300000317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rotharbor.xyz"; classtype:web-application-activity; sid:300000318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runadvanced-bestextremelyfile.best"; classtype:web-application-activity; sid:300000319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runcurrent-bestextremelyfile.best"; classtype:web-application-activity; sid:300000320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rundeveloped-bestoverlyfile.best"; classtype:web-application-activity; sid:300000321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestadvancedfile.best"; classtype:web-application-activity; sid:300000322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestcurrentfile.best"; classtype:web-application-activity; sid:300000323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestlatestfile.best"; classtype:web-application-activity; sid:300000324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestrecentfile.best"; classtype:web-application-activity; sid:300000325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runfree-bestoverlyfile.best"; classtype:web-application-activity; sid:300000326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runintensely-bestrenewedfile.best"; classtype:web-application-activity; sid:300000327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runlatest-besthighlyfile.best"; classtype:web-application-activity; sid:300000328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runnewest-bestextremelyfile.best"; classtype:web-application-activity; sid:300000329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoriginal-bestextremelyfile.best"; classtype:web-application-activity; sid:300000330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoriginal-bestintenselyfile.best"; classtype:web-application-activity; sid:300000331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestdevelopedfile.best"; classtype:web-application-activity; sid:300000332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestquickfile.best"; classtype:web-application-activity; sid:300000333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runrecent-bestextremelyfile.best"; classtype:web-application-activity; sid:300000335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runrecent-besthighlyfile.best"; classtype:web-application-activity; sid:300000336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safelyonline.tech"; classtype:web-application-activity; sid:300000337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safest4placeupdate.info"; classtype:web-application-activity; sid:300000338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safest4placeupdates.info"; classtype:web-application-activity; sid:300000339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"scheduleagreement.xyz"; classtype:web-application-activity; sid:300000340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"score-monitoring.xyz"; classtype:web-application-activity; sid:300000341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"search-tool.net"; classtype:web-application-activity; sid:300000342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"search-trends.co"; classtype:web-application-activity; sid:300000343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"searchfeed.co"; classtype:web-application-activity; sid:300000344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-alert.xyz"; classtype:web-application-activity; sid:300000345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-alerts.xyz"; classtype:web-application-activity; sid:300000346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-monitoring.xyz"; classtype:web-application-activity; sid:300000347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"second-handjam.xyz"; classtype:web-application-activity; sid:300000348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-made-easy.xyz"; classtype:web-application-activity; sid:300000349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-pro.xyz"; classtype:web-application-activity; sid:300000350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-protection.xyz"; classtype:web-application-activity; sid:300000351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"seemlast.monster"; classtype:web-application-activity; sid:300000352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"selfradiance.info"; classtype:web-application-activity; sid:300000353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shkshk.site"; classtype:web-application-activity; sid:300000354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shopnsave.world"; classtype:web-application-activity; sid:300000355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shoppingexp.xyz"; classtype:web-application-activity; sid:300000356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smartys.link"; classtype:web-application-activity; sid:300000357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetd.xyz"; classtype:web-application-activity; sid:300000358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspinb.xyz"; classtype:web-application-activity; sid:300000359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspotf.xyz"; classtype:web-application-activity; sid:300000360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetb.xyz"; classtype:web-application-activity; sid:300000361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitea.xyz"; classtype:web-application-activity; sid:300000362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitef.xyz"; classtype:web-application-activity; sid:300000363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stingyscent.xyz"; classtype:web-application-activity; sid:300000364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thefreefile.best"; classtype:web-application-activity; sid:300000365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thequickfile.best"; classtype:web-application-activity; sid:300000366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thespeedyfile.best"; classtype:web-application-activity; sid:300000367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thestrongfile.best"; classtype:web-application-activity; sid:300000368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storelatest-theoverlyfile.best"; classtype:web-application-activity; sid:300000369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storenewest-theoverlyfile.best"; classtype:web-application-activity; sid:300000370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-theadvancedfile.best"; classtype:web-application-activity; sid:300000371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thecurrentfile.best"; classtype:web-application-activity; sid:300000372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thelatestfile.best"; classtype:web-application-activity; sid:300000373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thenewestfile.best"; classtype:web-application-activity; sid:300000374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storerecent-theoverlyfile.best"; classtype:web-application-activity; sid:300000375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storespeedy-theheavilyfile.best"; classtype:web-application-activity; sid:300000376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeswift-theheavilyfile.best"; classtype:web-application-activity; sid:300000377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"styleandhealth.info"; classtype:web-application-activity; sid:300000378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"subeamy.pw"; classtype:web-application-activity; sid:300000379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sugar-legal-about13.fun"; classtype:web-application-activity; sid:300000380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superiorcare.info"; classtype:web-application-activity; sid:300000381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-club.club"; classtype:web-application-activity; sid:300000382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-review.club"; classtype:web-application-activity; sid:300000383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestoriginalfile.best"; classtype:web-application-activity; sid:300000384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncgreatly-bestrenewedfile.best"; classtype:web-application-activity; sid:300000386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncheavily-bestlatestfile.best"; classtype:web-application-activity; sid:300000387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestfreefile.best"; classtype:web-application-activity; sid:300000388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestoriginalfile.best"; classtype:web-application-activity; sid:300000389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestprogressivefile.best"; classtype:web-application-activity; sid:300000390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestrecentfile.best"; classtype:web-application-activity; sid:300000391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestspeedyfile.best"; classtype:web-application-activity; sid:300000393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncintensely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synclatest-bestuberfile.best"; classtype:web-application-activity; sid:300000395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncoriginal-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-besthighlyfile.best"; classtype:web-application-activity; sid:300000398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncrenewed-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestoriginalfile.best"; classtype:web-application-activity; sid:300000400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprecisefile.best"; classtype:web-application-activity; sid:300000401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"talskingest.top"; classtype:web-application-activity; sid:300000402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tastefulwood.xyz"; classtype:web-application-activity; sid:300000403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theable.me"; classtype:web-application-activity; sid:300000404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayer.info"; classtype:web-application-activity; sid:300000405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayers.info"; classtype:web-application-activity; sid:300000406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theconnectvpn.com"; classtype:web-application-activity; sid:300000407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecryptomoney.info"; classtype:web-application-activity; sid:300000408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefatburner.info"; classtype:web-application-activity; sid:300000409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefitproject.club"; classtype:web-application-activity; sid:300000410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcurve.info"; classtype:web-application-activity; sid:300000411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcycle.club"; classtype:web-application-activity; sid:300000412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthgo.info"; classtype:web-application-activity; sid:300000413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthpedia.info"; classtype:web-application-activity; sid:300000414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthystyle.info"; classtype:web-application-activity; sid:300000415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthyvibe.info"; classtype:web-application-activity; sid:300000416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehotshot.info"; classtype:web-application-activity; sid:300000417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thelastpicture.show"; classtype:web-application-activity; sid:300000418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thenewjourney.info"; classtype:web-application-activity; sid:300000419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thepackage.club"; classtype:web-application-activity; sid:300000420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestplayerlinks.work"; classtype:web-application-activity; sid:300000421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablealwayssafeupdates.work"; classtype:web-application-activity; sid:300000422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupdates.work"; classtype:web-application-activity; sid:300000423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupgrades.best"; classtype:web-application-activity; sid:300000424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thrillqueen.xyz"; classtype:web-application-activity; sid:300000425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toovolution.club"; classtype:web-application-activity; sid:300000426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topnotchsports.tips"; classtype:web-application-activity; sid:300000427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficbounce.net"; classtype:web-application-activity; sid:300000428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficgate.cc"; classtype:web-application-activity; sid:300000429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trkvpn.xyz"; classtype:web-application-activity; sid:300000430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uclaimrewards.net"; classtype:web-application-activity; sid:300000431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unequalfaucet.xyz"; classtype:web-application-activity; sid:300000432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uniremedy.info"; classtype:web-application-activity; sid:300000433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatcboulevard.xyz"; classtype:web-application-activity; sid:300000434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmstreet.xyz"; classtype:web-application-activity; sid:300000435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmway.xyz"; classtype:web-application-activity; sid:300000436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatecurrent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thecurrentfile.best"; classtype:web-application-activity; sid:300000438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thenewestfile.best"; classtype:web-application-activity; sid:300000439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-therecentfile.best"; classtype:web-application-activity; sid:300000440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatelatest-thegreatlyfile.best"; classtype:web-application-activity; sid:300000441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updaterecent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upmakesite.xyz"; classtype:web-application-activity; sid:300000443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upplayglobal.xyz"; classtype:web-application-activity; sid:300000444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vexearth.xyz"; classtype:web-application-activity; sid:300000445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viral-surveys.win"; classtype:web-application-activity; sid:300000446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viralarticles.net"; classtype:web-application-activity; sid:300000447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vital-health.club"; classtype:web-application-activity; sid:300000448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vitalrole.info"; classtype:web-application-activity; sid:300000449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn-pro.info"; classtype:web-application-activity; sid:300000450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnadefenceplus.com"; classtype:web-application-activity; sid:300000451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpntool.me"; classtype:web-application-activity; sid:300000452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"website4all.info"; classtype:web-application-activity; sid:300000453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websiteforall.work"; classtype:web-application-activity; sid:300000454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websitetoget.work"; classtype:web-application-activity; sid:300000455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessgram.info"; classtype:web-application-activity; sid:300000456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessplum.info"; classtype:web-application-activity; sid:300000457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wherentlybrane.site"; classtype:web-application-activity; sid:300000458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wowlifestyle.info"; classtype:web-application-activity; sid:300000459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrade.info"; classtype:web-application-activity; sid:300000460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrades.info"; classtype:web-application-activity; sid:300000461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrading.info"; classtype:web-application-activity; sid:300000462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnection.info"; classtype:web-application-activity; sid:300000463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnections.info"; classtype:web-application-activity; sid:300000464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayer.info"; classtype:web-application-activity; sid:300000465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayers.info"; classtype:web-application-activity; sid:300000466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdate.work"; classtype:web-application-activity; sid:300000469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdating.work"; classtype:web-application-activity; sid:300000470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestplayerlink.best"; classtype:web-application-activity; sid:300000473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestreliablelink.work"; classtype:web-application-activity; sid:300000474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelink.info"; classtype:web-application-activity; sid:300000475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelinks.info"; classtype:web-application-activity; sid:300000476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafesystemsupdating.work"; classtype:web-application-activity; sid:300000477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourultimateperfectupgrades.work"; classtype:web-application-activity; sid:300000478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ysfetinora.tk"; classtype:web-application-activity; sid:300000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"animenation.org"; classtype:web-application-activity; sid:300000011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apptool.me"; classtype:web-application-activity; sid:300000012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ashtdi.cn"; classtype:web-application-activity; sid:300000013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"assuredhealth.info"; classtype:web-application-activity; sid:300000014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"asufij.xyz"; classtype:web-application-activity; sid:300000015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"auto-lawyer.site"; classtype:web-application-activity; sid:300000016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"baseofmp3.com"; classtype:web-application-activity; sid:300000017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrade.info"; classtype:web-application-activity; sid:300000018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrades.info"; classtype:web-application-activity; sid:300000019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrading.info"; classtype:web-application-activity; sid:300000020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestresults.xyz"; classtype:web-application-activity; sid:300000021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayer.info"; classtype:web-application-activity; sid:300000022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayers.info"; classtype:web-application-activity; sid:300000023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayer.info"; classtype:web-application-activity; sid:300000024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayers.info"; classtype:web-application-activity; sid:300000025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigcbd.info"; classtype:web-application-activity; sid:300000026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigdaycasino.info"; classtype:web-application-activity; sid:300000027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoin-trader.me"; classtype:web-application-activity; sid:300000028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bittrend.com"; classtype:web-application-activity; sid:300000029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biztherapy.info"; classtype:web-application-activity; sid:300000030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyamaze.club"; classtype:web-application-activity; sid:300000031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyselfcare.info"; classtype:web-application-activity; sid:300000032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browsercheck.site"; classtype:web-application-activity; sid:300000033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"btcinvesting.info"; classtype:web-application-activity; sid:300000034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bulley.shop"; classtype:web-application-activity; sid:300000035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cabins-r-us.com"; classtype:web-application-activity; sid:300000036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calculateprint.xyz"; classtype:web-application-activity; sid:300000037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carebility.info"; classtype:web-application-activity; sid:300000038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carevision.info"; classtype:web-application-activity; sid:300000039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"celebseven.com"; classtype:web-application-activity; sid:300000040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"centrodeartigos.com"; classtype:web-application-activity; sid:300000041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cheerplaceweb.xyz"; classtype:web-application-activity; sid:300000042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coachbelief.xyz"; classtype:web-application-activity; sid:300000043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"collectrewards.net"; classtype:web-application-activity; sid:300000044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"comphp.xyz"; classtype:web-application-activity; sid:300000045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceivecolor.xyz"; classtype:web-application-activity; sid:300000046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conflaqpzc.info"; classtype:web-application-activity; sid:300000047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cooing.top"; classtype:web-application-activity; sid:300000048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-alerts.xyz"; classtype:web-application-activity; sid:300000049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-monitor.xyz"; classtype:web-application-activity; sid:300000050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-resources.xyz"; classtype:web-application-activity; sid:300000051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotradingcourses.net"; classtype:web-application-activity; sid:300000052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptounlimited.info"; classtype:web-application-activity; sid:300000053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cs-alerts.xyz"; classtype:web-application-activity; sid:300000054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cselfconnect.com"; classtype:web-application-activity; sid:300000055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curesector.today"; classtype:web-application-activity; sid:300000056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"degreenm.top"; classtype:web-application-activity; sid:300000057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"delightcmain.xyz"; classtype:web-application-activity; sid:300000058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digitalinvest.news"; classtype:web-application-activity; sid:300000059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"displayfriend.xyz"; classtype:web-application-activity; sid:300000060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ditvl.com"; classtype:web-application-activity; sid:300000061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonballclub.com"; classtype:web-application-activity; sid:300000062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ehousan.top"; classtype:web-application-activity; sid:300000063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eproute.info"; classtype:web-application-activity; sid:300000064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eroanimeittyokusen.com"; classtype:web-application-activity; sid:300000065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erotica.live"; classtype:web-application-activity; sid:300000066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"excitingthing.xyz"; classtype:web-application-activity; sid:300000067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrasafe.xyz"; classtype:web-application-activity; sid:300000068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"facebook-sex.com"; classtype:web-application-activity; sid:300000069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapf.xyz"; classtype:web-application-activity; sid:300000070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastplanetf.xyz"; classtype:web-application-activity; sid:300000071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspotb.xyz"; classtype:web-application-activity; sid:300000072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastwebe.xyz"; classtype:web-application-activity; sid:300000073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmesonlineturbo.net"; classtype:web-application-activity; sid:300000074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmrod.xyz"; classtype:web-application-activity; sid:300000075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"films-down.com"; classtype:web-application-activity; sid:300000076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"financial-deals.xyz"; classtype:web-application-activity; sid:300000077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findforus.net"; classtype:web-application-activity; sid:300000078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findoffers.co"; classtype:web-application-activity; sid:300000079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces4download.work"; classtype:web-application-activity; sid:300000080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findyourultimateplayersfirst.best"; classtype:web-application-activity; sid:300000081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"firststableplayer.work"; classtype:web-application-activity; sid:300000082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisham.site"; classtype:web-application-activity; sid:300000083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandready.info"; classtype:web-application-activity; sid:300000084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandstable.club"; classtype:web-application-activity; sid:300000085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitbodyandsoul.info"; classtype:web-application-activity; sid:300000086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitcourage.info"; classtype:web-application-activity; sid:300000087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspark.info"; classtype:web-application-activity; sid:300000088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspot.club"; classtype:web-application-activity; sid:300000089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthsure.info"; classtype:web-application-activity; sid:300000090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitlifevalue.info"; classtype:web-application-activity; sid:300000091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitnessdial.club"; classtype:web-application-activity; sid:300000092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitsure.info"; classtype:web-application-activity; sid:300000093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flatbellylife.info"; classtype:web-application-activity; sid:300000094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foregoingpump.xyz"; classtype:web-application-activity; sid:300000095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forsalecheap.net"; classtype:web-application-activity; sid:300000096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrade.work"; classtype:web-application-activity; sid:300000097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freshclover.info"; classtype:web-application-activity; sid:300000098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fuck-me-hard.club"; classtype:web-application-activity; sid:300000099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapc.xyz"; classtype:web-application-activity; sid:300000100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapd.xyz"; classtype:web-application-activity; sid:300000101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funplanetb.xyz"; classtype:web-application-activity; sid:300000102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funsiteb.xyz"; classtype:web-application-activity; sid:300000103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspinf.xyz"; classtype:web-application-activity; sid:300000104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspotf.xyz"; classtype:web-application-activity; sid:300000105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funwebd.xyz"; classtype:web-application-activity; sid:300000106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fwsxqc.cn"; classtype:web-application-activity; sid:300000107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gainhealth.info"; classtype:web-application-activity; sid:300000108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gapingshame.xyz"; classtype:web-application-activity; sid:300000109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generouscare.info"; classtype:web-application-activity; sid:300000110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getstablesystemupgrades.work"; classtype:web-application-activity; sid:300000111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladcboulevard.xyz"; classtype:web-application-activity; sid:300000112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladdboulevard.xyz"; classtype:web-application-activity; sid:300000113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladplaceweb.xyz"; classtype:web-application-activity; sid:300000114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladslotweb.xyz"; classtype:web-application-activity; sid:300000115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotplay.xyz"; classtype:web-application-activity; sid:300000116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotwonder.xyz"; classtype:web-application-activity; sid:300000117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.fun"; classtype:web-application-activity; sid:300000118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.online"; classtype:web-application-activity; sid:300000119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.site"; classtype:web-application-activity; sid:300000120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.surf"; classtype:web-application-activity; sid:300000121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.website"; classtype:web-application-activity; sid:300000122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.fun"; classtype:web-application-activity; sid:300000123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.store"; classtype:web-application-activity; sid:300000124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"govpshosting.com"; classtype:web-application-activity; sid:300000125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"graburprize.net"; classtype:web-application-activity; sid:300000126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gramp.xyz"; classtype:web-application-activity; sid:300000127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"grandcasinoprize.info"; classtype:web-application-activity; sid:300000128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"greatplaceofstubs.work"; classtype:web-application-activity; sid:300000129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"greatsearch.xyz"; classtype:web-application-activity; sid:300000130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"growthnetic.club"; classtype:web-application-activity; sid:300000131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hailso.xyz"; classtype:web-application-activity; sid:300000132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"haircarepro.info"; classtype:web-application-activity; sid:300000133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"happyactive.today"; classtype:web-application-activity; sid:300000134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"happymakeworld.xyz"; classtype:web-application-activity; sid:300000135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healandgrow.club"; classtype:web-application-activity; sid:300000136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthdefine.info"; classtype:web-application-activity; sid:300000137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthdome.info"; classtype:web-application-activity; sid:300000138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healtheezy.info"; classtype:web-application-activity; sid:300000139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthemerge.info"; classtype:web-application-activity; sid:300000140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthjolly.info"; classtype:web-application-activity; sid:300000141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmainly.info"; classtype:web-application-activity; sid:300000142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmaintain.info"; classtype:web-application-activity; sid:300000143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmama.info"; classtype:web-application-activity; sid:300000144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmanic.info"; classtype:web-application-activity; sid:300000145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthmarlin.club"; classtype:web-application-activity; sid:300000146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthneo.club"; classtype:web-application-activity; sid:300000147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthomega.club"; classtype:web-application-activity; sid:300000148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthready.info"; classtype:web-application-activity; sid:300000149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthreportsweb.info"; classtype:web-application-activity; sid:300000150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthreward.info"; classtype:web-application-activity; sid:300000151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthroll.info"; classtype:web-application-activity; sid:300000152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthscale.club"; classtype:web-application-activity; sid:300000153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthschedule.club"; classtype:web-application-activity; sid:300000154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthspark.today"; classtype:web-application-activity; sid:300000155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthsupreme.club"; classtype:web-application-activity; sid:300000156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthtag.club"; classtype:web-application-activity; sid:300000157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthupper.club"; classtype:web-application-activity; sid:300000158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthvenue.club"; classtype:web-application-activity; sid:300000159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthvibe.live"; classtype:web-application-activity; sid:300000160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthwella.club"; classtype:web-application-activity; sid:300000161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthy-lifestyle.club"; classtype:web-application-activity; sid:300000162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthyideal.club"; classtype:web-application-activity; sid:300000163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthyparker.info"; classtype:web-application-activity; sid:300000164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthysure.info"; classtype:web-application-activity; sid:300000165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idtheft-alert.xyz"; classtype:web-application-activity; sid:300000166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iketo.diet"; classtype:web-application-activity; sid:300000167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inappropriate.top"; classtype:web-application-activity; sid:300000168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"information.casa"; classtype:web-application-activity; sid:300000169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instablog.club"; classtype:web-application-activity; sid:300000170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"insuredhealth.info"; classtype:web-application-activity; sid:300000171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosrecommendedvpn.com"; classtype:web-application-activity; sid:300000172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"izipik.com"; classtype:web-application-activity; sid:300000173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyplaceplay.xyz"; classtype:web-application-activity; sid:300000174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotmap.xyz"; classtype:web-application-activity; sid:300000175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotspin.xyz"; classtype:web-application-activity; sid:300000176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jsrenthouse.com"; classtype:web-application-activity; sid:300000177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jubilantdstreet.xyz"; classtype:web-application-activity; sid:300000178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kad3md.cn"; classtype:web-application-activity; sid:300000179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keepithealthy.info"; classtype:web-application-activity; sid:300000180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketodietrecipes.org"; classtype:web-application-activity; sid:300000181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leeching.net"; classtype:web-application-activity; sid:300000182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrading.info"; classtype:web-application-activity; sid:300000185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplayerupdates.work"; classtype:web-application-activity; sid:300000186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendarysiteupgrading.work"; classtype:web-application-activity; sid:300000187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrade.info"; classtype:web-application-activity; sid:300000188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"life-esteem.info"; classtype:web-application-activity; sid:300000191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifecaregoal.info"; classtype:web-application-activity; sid:300000192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lightstop.xyz"; classtype:web-application-activity; sid:300000193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livehealthcare.today"; classtype:web-application-activity; sid:300000194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livelyyroad.xyz"; classtype:web-application-activity; sid:300000195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livingmighty.club"; classtype:web-application-activity; sid:300000196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadfree-bestheavilyfile.best"; classtype:web-application-activity; sid:300000197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestadvancedfile.best"; classtype:web-application-activity; sid:300000198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestquickfile.best"; classtype:web-application-activity; sid:300000199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadheavily-bestfreefile.best"; classtype:web-application-activity; sid:300000200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loosefit.info"; classtype:web-application-activity; sid:300000201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loveorfun.cc"; classtype:web-application-activity; sid:300000202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckjackcasino.info"; classtype:web-application-activity; sid:300000203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckymedia.fun"; classtype:web-application-activity; sid:300000204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckymedia.space"; classtype:web-application-activity; sid:300000205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"madpandatv.net"; classtype:web-application-activity; sid:300000206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"majorhealthpro.info"; classtype:web-application-activity; sid:300000207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"makemesafeios.com"; classtype:web-application-activity; sid:300000208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managestrong-theuberfile.best"; classtype:web-application-activity; sid:300000209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-thenewestfile.best"; classtype:web-application-activity; sid:300000210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-therecentfile.best"; classtype:web-application-activity; sid:300000211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-thestrongfile.best"; classtype:web-application-activity; sid:300000212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manageuber-theswiftfile.best"; classtype:web-application-activity; sid:300000213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mathison.io"; classtype:web-application-activity; sid:300000214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"max-care.info"; classtype:web-application-activity; sid:300000215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mediaplayer24.ml"; classtype:web-application-activity; sid:300000216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medicomatic.info"; classtype:web-application-activity; sid:300000217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medjournalketo.info"; classtype:web-application-activity; sid:300000218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medsjournal.info"; classtype:web-application-activity; sid:300000219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meeryslotspin.xyz"; classtype:web-application-activity; sid:300000220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merryplayglobal.xyz"; classtype:web-application-activity; sid:300000221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merryplayworld.xyz"; classtype:web-application-activity; sid:300000222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mindbank.ai"; classtype:web-application-activity; sid:300000223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mindmatch.ai"; classtype:web-application-activity; sid:300000224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mistraffic.me"; classtype:web-application-activity; sid:300000225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modern-security.xyz"; classtype:web-application-activity; sid:300000226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"monitoring-credit.xyz"; classtype:web-application-activity; sid:300000227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"multitax.xyz"; classtype:web-application-activity; sid:300000228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"newsitedowloads.site"; classtype:web-application-activity; sid:300000229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nogfw.pro"; classtype:web-application-activity; sid:300000230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nosyknot.xyz"; classtype:web-application-activity; sid:300000231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nutrinamic.info"; classtype:web-application-activity; sid:300000232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onegowc.pw"; classtype:web-application-activity; sid:300000233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onlinecinema.eu"; classtype:web-application-activity; sid:300000234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatecompletely-theprecisefile.best"; classtype:web-application-activity; sid:300000235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatecompletely-thespeedyfile.best"; classtype:web-application-activity; sid:300000236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateextremely-theprogressivefile.best"; classtype:web-application-activity; sid:300000237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateextremely-therenewedfile.best"; classtype:web-application-activity; sid:300000238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatefree-theuberfile.best"; classtype:web-application-activity; sid:300000239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operategreatly-therefinedfile.best"; classtype:web-application-activity; sid:300000240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operategreatly-theswiftfile.best"; classtype:web-application-activity; sid:300000241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatehighly-thespeedyfile.best"; classtype:web-application-activity; sid:300000242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatehighly-thestrongfile.best"; classtype:web-application-activity; sid:300000243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateintensely-theprogressivefile.best"; classtype:web-application-activity; sid:300000244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateintensely-thestrongfile.best"; classtype:web-application-activity; sid:300000245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatenewest-theuberfile.best"; classtype:web-application-activity; sid:300000246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoriginal-themostfile.best"; classtype:web-application-activity; sid:300000247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoriginal-theuberfile.best"; classtype:web-application-activity; sid:300000248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateoverly-thesophisticatedfile.best"; classtype:web-application-activity; sid:300000249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateprecise-thecompletelyfile.best"; classtype:web-application-activity; sid:300000250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateprogressive-theintenselyfile.best"; classtype:web-application-activity; sid:300000251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatequick-themostfile.best"; classtype:web-application-activity; sid:300000252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operaterefined-thegreatlyfile.best"; classtype:web-application-activity; sid:300000253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operaterenewed-theextremelyfile.best"; classtype:web-application-activity; sid:300000254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatesophisticated-theoverlyfile.best"; classtype:web-application-activity; sid:300000255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operatespeedy-thehighlyfile.best"; classtype:web-application-activity; sid:300000256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateuber-thefreefile.best"; classtype:web-application-activity; sid:300000257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"operateuber-theoriginalfile.best"; classtype:web-application-activity; sid:300000258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patriothealth.today"; classtype:web-application-activity; sid:300000259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pcicompliancemanager.xyz"; classtype:web-application-activity; sid:300000260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perfectplaceonnetforplayers.work"; classtype:web-application-activity; sid:300000261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performcompletely-thelatestfile.best"; classtype:web-application-activity; sid:300000262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performcompletely-thequickfile.best"; classtype:web-application-activity; sid:300000263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performextremely-theprecisefile.best"; classtype:web-application-activity; sid:300000264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performfree-thehighlyfile.best"; classtype:web-application-activity; sid:300000265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performgreatly-thespeedyfile.best"; classtype:web-application-activity; sid:300000266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performheavily-theoriginalfile.best"; classtype:web-application-activity; sid:300000267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-thefreefile.best"; classtype:web-application-activity; sid:300000268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-theprecisefile.best"; classtype:web-application-activity; sid:300000269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performhighly-therecentfile.best"; classtype:web-application-activity; sid:300000270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performintensely-thedevelopedfile.best"; classtype:web-application-activity; sid:300000271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performlatest-thecompletelyfile.best"; classtype:web-application-activity; sid:300000272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performmost-thenewestfile.best"; classtype:web-application-activity; sid:300000273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performmost-therecentfile.best"; classtype:web-application-activity; sid:300000274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoriginal-theheavilyfile.best"; classtype:web-application-activity; sid:300000275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoriginal-theuberfile.best"; classtype:web-application-activity; sid:300000276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performoverly-theprogressivefile.best"; classtype:web-application-activity; sid:300000277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprecise-theextremelyfile.best"; classtype:web-application-activity; sid:300000278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprecise-thehighlyfile.best"; classtype:web-application-activity; sid:300000279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprogressive-theintenselyfile.best"; classtype:web-application-activity; sid:300000280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performprogressive-theoverlyfile.best"; classtype:web-application-activity; sid:300000281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performquick-thecompletelyfile.best"; classtype:web-application-activity; sid:300000282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrecent-themostfile.best"; classtype:web-application-activity; sid:300000283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrefined-theextremelyfile.best"; classtype:web-application-activity; sid:300000284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performrenewed-theoverlyfile.best"; classtype:web-application-activity; sid:300000285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performsophisticated-thehighlyfile.best"; classtype:web-application-activity; sid:300000286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performspeedy-thegreatlyfile.best"; classtype:web-application-activity; sid:300000287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performuber-theoriginalfile.best"; classtype:web-application-activity; sid:300000288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"performuber-therenewedfile.best"; classtype:web-application-activity; sid:300000289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"piorkeepi.top"; classtype:web-application-activity; sid:300000290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"placesiteb.xyz"; classtype:web-application-activity; sid:300000291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"placesitee.xyz"; classtype:web-application-activity; sid:300000292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"placewebe.xyz"; classtype:web-application-activity; sid:300000293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"plampo.xyz"; classtype:web-application-activity; sid:300000294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspina.xyz"; classtype:web-application-activity; sid:300000295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspind.xyz"; classtype:web-application-activity; sid:300000296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playspote.xyz"; classtype:web-application-activity; sid:300000297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"premiernursingacademy.org"; classtype:web-application-activity; sid:300000298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"preparedforsafeupgrading.work"; classtype:web-application-activity; sid:300000299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primawise.info"; classtype:web-application-activity; sid:300000300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primecare.today"; classtype:web-application-activity; sid:300000301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"productiq.net"; classtype:web-application-activity; sid:300000302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prohealthroutine.info"; classtype:web-application-activity; sid:300000303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protect-connection.com"; classtype:web-application-activity; sid:300000304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protectyourvpn.com"; classtype:web-application-activity; sid:300000305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readyhealth.info"; classtype:web-application-activity; sid:300000306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readyhealthgo.today"; classtype:web-application-activity; sid:300000307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.casa"; classtype:web-application-activity; sid:300000308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.cyou"; classtype:web-application-activity; sid:300000309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.fun"; classtype:web-application-activity; sid:300000310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.site"; classtype:web-application-activity; sid:300000311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.space"; classtype:web-application-activity; sid:300000312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.surf"; classtype:web-application-activity; sid:300000313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recontent.website"; classtype:web-application-activity; sid:300000314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"reliablesoftwarevideos.info"; classtype:web-application-activity; sid:300000315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"remedify.info"; classtype:web-application-activity; sid:300000316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.casa"; classtype:web-application-activity; sid:300000317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.fun"; classtype:web-application-activity; sid:300000318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.online"; classtype:web-application-activity; sid:300000319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.site"; classtype:web-application-activity; sid:300000320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"renewvideo.website"; classtype:web-application-activity; sid:300000321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"resignation.top"; classtype:web-application-activity; sid:300000322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"roadtoyourhealth.info"; classtype:web-application-activity; sid:300000323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"robogarden.io"; classtype:web-application-activity; sid:300000324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rootessential.info"; classtype:web-application-activity; sid:300000325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rotharbor.xyz"; classtype:web-application-activity; sid:300000326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runadvanced-bestextremelyfile.best"; classtype:web-application-activity; sid:300000327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runcurrent-bestextremelyfile.best"; classtype:web-application-activity; sid:300000328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rundeveloped-bestoverlyfile.best"; classtype:web-application-activity; sid:300000329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestadvancedfile.best"; classtype:web-application-activity; sid:300000330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestcurrentfile.best"; classtype:web-application-activity; sid:300000331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestlatestfile.best"; classtype:web-application-activity; sid:300000332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runextremely-bestrecentfile.best"; classtype:web-application-activity; sid:300000333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runfree-bestoverlyfile.best"; classtype:web-application-activity; sid:300000334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runintensely-bestrenewedfile.best"; classtype:web-application-activity; sid:300000335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runlatest-besthighlyfile.best"; classtype:web-application-activity; sid:300000336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runnewest-bestextremelyfile.best"; classtype:web-application-activity; sid:300000337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoriginal-bestextremelyfile.best"; classtype:web-application-activity; sid:300000338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoriginal-bestintenselyfile.best"; classtype:web-application-activity; sid:300000339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestdevelopedfile.best"; classtype:web-application-activity; sid:300000340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestquickfile.best"; classtype:web-application-activity; sid:300000341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runoverly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runrecent-bestextremelyfile.best"; classtype:web-application-activity; sid:300000343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"runrecent-besthighlyfile.best"; classtype:web-application-activity; sid:300000344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safelyonline.tech"; classtype:web-application-activity; sid:300000345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safest4placeupdate.info"; classtype:web-application-activity; sid:300000346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"safest4placeupdates.info"; classtype:web-application-activity; sid:300000347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"scheduleagreement.xyz"; classtype:web-application-activity; sid:300000348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"score-monitoring.xyz"; classtype:web-application-activity; sid:300000349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"search-tool.net"; classtype:web-application-activity; sid:300000350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"search-trends.co"; classtype:web-application-activity; sid:300000351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"searchfeed.co"; classtype:web-application-activity; sid:300000352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-alert.xyz"; classtype:web-application-activity; sid:300000353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-alerts.xyz"; classtype:web-application-activity; sid:300000354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sec-monitoring.xyz"; classtype:web-application-activity; sid:300000355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"second-handjam.xyz"; classtype:web-application-activity; sid:300000356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-made-easy.xyz"; classtype:web-application-activity; sid:300000357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-pro.xyz"; classtype:web-application-activity; sid:300000358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"security-protection.xyz"; classtype:web-application-activity; sid:300000359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"seemlast.monster"; classtype:web-application-activity; sid:300000360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"selfradiance.info"; classtype:web-application-activity; sid:300000361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shkshk.site"; classtype:web-application-activity; sid:300000362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shopnsave.world"; classtype:web-application-activity; sid:300000363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shoppingexp.xyz"; classtype:web-application-activity; sid:300000364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smartys.link"; classtype:web-application-activity; sid:300000365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetd.xyz"; classtype:web-application-activity; sid:300000366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspinb.xyz"; classtype:web-application-activity; sid:300000367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspotf.xyz"; classtype:web-application-activity; sid:300000368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetb.xyz"; classtype:web-application-activity; sid:300000369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitea.xyz"; classtype:web-application-activity; sid:300000370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitef.xyz"; classtype:web-application-activity; sid:300000371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stingyscent.xyz"; classtype:web-application-activity; sid:300000372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thefreefile.best"; classtype:web-application-activity; sid:300000373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thequickfile.best"; classtype:web-application-activity; sid:300000374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thespeedyfile.best"; classtype:web-application-activity; sid:300000375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thestrongfile.best"; classtype:web-application-activity; sid:300000376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storelatest-theoverlyfile.best"; classtype:web-application-activity; sid:300000377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storenewest-theoverlyfile.best"; classtype:web-application-activity; sid:300000378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-theadvancedfile.best"; classtype:web-application-activity; sid:300000379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thecurrentfile.best"; classtype:web-application-activity; sid:300000380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thelatestfile.best"; classtype:web-application-activity; sid:300000381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thenewestfile.best"; classtype:web-application-activity; sid:300000382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storerecent-theoverlyfile.best"; classtype:web-application-activity; sid:300000383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storespeedy-theheavilyfile.best"; classtype:web-application-activity; sid:300000384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeswift-theheavilyfile.best"; classtype:web-application-activity; sid:300000385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"styleandhealth.info"; classtype:web-application-activity; sid:300000386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"subeamy.pw"; classtype:web-application-activity; sid:300000387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sugar-legal-about13.fun"; classtype:web-application-activity; sid:300000388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superiorcare.info"; classtype:web-application-activity; sid:300000389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-club.club"; classtype:web-application-activity; sid:300000390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-review.club"; classtype:web-application-activity; sid:300000391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestoriginalfile.best"; classtype:web-application-activity; sid:300000392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncgreatly-bestrenewedfile.best"; classtype:web-application-activity; sid:300000394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncheavily-bestlatestfile.best"; classtype:web-application-activity; sid:300000395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestfreefile.best"; classtype:web-application-activity; sid:300000396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestoriginalfile.best"; classtype:web-application-activity; sid:300000397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestprogressivefile.best"; classtype:web-application-activity; sid:300000398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestrecentfile.best"; classtype:web-application-activity; sid:300000399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestspeedyfile.best"; classtype:web-application-activity; sid:300000401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncintensely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synclatest-bestuberfile.best"; classtype:web-application-activity; sid:300000403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncoriginal-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-besthighlyfile.best"; classtype:web-application-activity; sid:300000406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncrenewed-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestoriginalfile.best"; classtype:web-application-activity; sid:300000408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprecisefile.best"; classtype:web-application-activity; sid:300000409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tackis.xyz"; classtype:web-application-activity; sid:300000410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"talskingest.top"; classtype:web-application-activity; sid:300000411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tastefulwood.xyz"; classtype:web-application-activity; sid:300000412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theable.me"; classtype:web-application-activity; sid:300000413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayer.info"; classtype:web-application-activity; sid:300000414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayers.info"; classtype:web-application-activity; sid:300000415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theconnectvpn.com"; classtype:web-application-activity; sid:300000416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecryptomoney.info"; classtype:web-application-activity; sid:300000417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefatburner.info"; classtype:web-application-activity; sid:300000418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefitproject.club"; classtype:web-application-activity; sid:300000419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcurve.info"; classtype:web-application-activity; sid:300000420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcycle.club"; classtype:web-application-activity; sid:300000421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthgo.info"; classtype:web-application-activity; sid:300000422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthpedia.info"; classtype:web-application-activity; sid:300000423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthystyle.info"; classtype:web-application-activity; sid:300000424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthyvibe.info"; classtype:web-application-activity; sid:300000425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehotshot.info"; classtype:web-application-activity; sid:300000426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thenewjourney.info"; classtype:web-application-activity; sid:300000427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thepackage.club"; classtype:web-application-activity; sid:300000428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestplayerlinks.work"; classtype:web-application-activity; sid:300000429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theslotomania.info"; classtype:web-application-activity; sid:300000430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablealwayssafeupdates.work"; classtype:web-application-activity; sid:300000431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupdates.work"; classtype:web-application-activity; sid:300000432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupgrades.best"; classtype:web-application-activity; sid:300000433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thrillqueen.xyz"; classtype:web-application-activity; sid:300000434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toovolution.club"; classtype:web-application-activity; sid:300000435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topnotchsports.tips"; classtype:web-application-activity; sid:300000436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficbounce.net"; classtype:web-application-activity; sid:300000437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficgate.cc"; classtype:web-application-activity; sid:300000438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trkvpn.xyz"; classtype:web-application-activity; sid:300000439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uclaimrewards.net"; classtype:web-application-activity; sid:300000440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unequalfaucet.xyz"; classtype:web-application-activity; sid:300000441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uniremedy.info"; classtype:web-application-activity; sid:300000442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatcboulevard.xyz"; classtype:web-application-activity; sid:300000443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmstreet.xyz"; classtype:web-application-activity; sid:300000444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmway.xyz"; classtype:web-application-activity; sid:300000445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatecurrent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thecurrentfile.best"; classtype:web-application-activity; sid:300000447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thenewestfile.best"; classtype:web-application-activity; sid:300000448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-therecentfile.best"; classtype:web-application-activity; sid:300000449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatelatest-thegreatlyfile.best"; classtype:web-application-activity; sid:300000450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updaterecent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upmakesite.xyz"; classtype:web-application-activity; sid:300000452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upplayglobal.xyz"; classtype:web-application-activity; sid:300000453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vexearth.xyz"; classtype:web-application-activity; sid:300000454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viral-surveys.win"; classtype:web-application-activity; sid:300000455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viralarticles.net"; classtype:web-application-activity; sid:300000456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vital-health.club"; classtype:web-application-activity; sid:300000457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vitalrole.info"; classtype:web-application-activity; sid:300000458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn-pro.info"; classtype:web-application-activity; sid:300000459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnadefenceplus.com"; classtype:web-application-activity; sid:300000460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpntool.me"; classtype:web-application-activity; sid:300000461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"website4all.info"; classtype:web-application-activity; sid:300000462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websiteforall.work"; classtype:web-application-activity; sid:300000463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websitetoget.work"; classtype:web-application-activity; sid:300000464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"webtip.co"; classtype:web-application-activity; sid:300000465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessgram.info"; classtype:web-application-activity; sid:300000466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessplum.info"; classtype:web-application-activity; sid:300000467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wherentlybrane.site"; classtype:web-application-activity; sid:300000468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wowlifestyle.info"; classtype:web-application-activity; sid:300000469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrade.info"; classtype:web-application-activity; sid:300000470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrades.info"; classtype:web-application-activity; sid:300000471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrading.info"; classtype:web-application-activity; sid:300000472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnection.info"; classtype:web-application-activity; sid:300000473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnections.info"; classtype:web-application-activity; sid:300000474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayer.info"; classtype:web-application-activity; sid:300000475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayers.info"; classtype:web-application-activity; sid:300000476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdate.work"; classtype:web-application-activity; sid:300000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdating.work"; classtype:web-application-activity; sid:300000480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestplayerlink.best"; classtype:web-application-activity; sid:300000483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestreliablelink.work"; classtype:web-application-activity; sid:300000484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelink.info"; classtype:web-application-activity; sid:300000485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelinks.info"; classtype:web-application-activity; sid:300000486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafesystemsupdating.work"; classtype:web-application-activity; sid:300000487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourultimateperfectupgrades.work"; classtype:web-application-activity; sid:300000488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ysfetinora.tk"; classtype:web-application-activity; sid:300000489; rev:1;) diff --git a/dist/pup-filter-unbound.conf b/dist/pup-filter-unbound.conf index 0a75633..fbc23b4 100644 --- a/dist/pup-filter-unbound.conf +++ b/dist/pup-filter-unbound.conf @@ -1,6 +1,6 @@ # Title: PUP Domains Unbound Blocklist # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ local-zone: "123news.website" always_nxdomain local-zone: "20patogh.com" always_nxdomain local-zone: "321movies.xyz" always_nxdomain -local-zone: "4uabs.club" always_nxdomain local-zone: "7awwa2.xyz" always_nxdomain +local-zone: "abcscience.xyz" always_nxdomain local-zone: "abeah-security.xyz" always_nxdomain local-zone: "adrondespi.top" always_nxdomain local-zone: "advancecare.info" always_nxdomain local-zone: "akb48wrapup.com" always_nxdomain local-zone: "amateurxporn.com" always_nxdomain +local-zone: "animenation.org" always_nxdomain local-zone: "apptool.me" always_nxdomain local-zone: "ashtdi.cn" always_nxdomain local-zone: "assuredhealth.info" always_nxdomain @@ -37,10 +38,10 @@ local-zone: "biztherapy.info" always_nxdomain local-zone: "bodyamaze.club" always_nxdomain local-zone: "bodyselfcare.info" always_nxdomain local-zone: "browsercheck.site" always_nxdomain +local-zone: "btcinvesting.info" always_nxdomain local-zone: "bulley.shop" always_nxdomain local-zone: "cabins-r-us.com" always_nxdomain local-zone: "calculateprint.xyz" always_nxdomain -local-zone: "care-connection.info" always_nxdomain local-zone: "carebility.info" always_nxdomain local-zone: "carevision.info" always_nxdomain local-zone: "celebseven.com" always_nxdomain @@ -81,6 +82,7 @@ local-zone: "filmesonlineturbo.net" always_nxdomain local-zone: "filmrod.xyz" always_nxdomain local-zone: "films-down.com" always_nxdomain local-zone: "financial-deals.xyz" always_nxdomain +local-zone: "findforus.net" always_nxdomain local-zone: "findoffers.co" always_nxdomain local-zone: "findperfectplaces4download.work" always_nxdomain local-zone: "findyourultimateplayersfirst.best" always_nxdomain @@ -132,11 +134,13 @@ local-zone: "graburprize.net" always_nxdomain local-zone: "gramp.xyz" always_nxdomain local-zone: "grandcasinoprize.info" always_nxdomain local-zone: "greatplaceofstubs.work" always_nxdomain +local-zone: "greatsearch.xyz" always_nxdomain local-zone: "growthnetic.club" always_nxdomain local-zone: "hailso.xyz" always_nxdomain local-zone: "haircarepro.info" always_nxdomain local-zone: "happyactive.today" always_nxdomain local-zone: "happymakeworld.xyz" always_nxdomain +local-zone: "healandgrow.club" always_nxdomain local-zone: "healthdefine.info" always_nxdomain local-zone: "healthdome.info" always_nxdomain local-zone: "healtheezy.info" always_nxdomain @@ -223,6 +227,7 @@ local-zone: "medsjournal.info" always_nxdomain local-zone: "meeryslotspin.xyz" always_nxdomain local-zone: "merryplayglobal.xyz" always_nxdomain local-zone: "merryplayworld.xyz" always_nxdomain +local-zone: "mindbank.ai" always_nxdomain local-zone: "mindmatch.ai" always_nxdomain local-zone: "mistraffic.me" always_nxdomain local-zone: "modern-security.xyz" always_nxdomain @@ -233,6 +238,7 @@ local-zone: "nogfw.pro" always_nxdomain local-zone: "nosyknot.xyz" always_nxdomain local-zone: "nutrinamic.info" always_nxdomain local-zone: "onegowc.pw" always_nxdomain +local-zone: "onlinecinema.eu" always_nxdomain local-zone: "operatecompletely-theprecisefile.best" always_nxdomain local-zone: "operatecompletely-thespeedyfile.best" always_nxdomain local-zone: "operateextremely-theprogressivefile.best" always_nxdomain @@ -289,6 +295,7 @@ local-zone: "performspeedy-thegreatlyfile.best" always_nxdomain local-zone: "performuber-theoriginalfile.best" always_nxdomain local-zone: "performuber-therenewedfile.best" always_nxdomain local-zone: "piorkeepi.top" always_nxdomain +local-zone: "placesiteb.xyz" always_nxdomain local-zone: "placesitee.xyz" always_nxdomain local-zone: "placewebe.xyz" always_nxdomain local-zone: "plampo.xyz" always_nxdomain @@ -299,6 +306,7 @@ local-zone: "premiernursingacademy.org" always_nxdomain local-zone: "preparedforsafeupgrading.work" always_nxdomain local-zone: "primawise.info" always_nxdomain local-zone: "primecare.today" always_nxdomain +local-zone: "productiq.net" always_nxdomain local-zone: "prohealthroutine.info" always_nxdomain local-zone: "protect-connection.com" always_nxdomain local-zone: "protectyourvpn.com" always_nxdomain @@ -406,6 +414,7 @@ local-zone: "syncprogressive-besthighlyfile.best" always_nxdomain local-zone: "syncrenewed-bestcompletelyfile.best" always_nxdomain local-zone: "syncuber-bestoriginalfile.best" always_nxdomain local-zone: "syncuber-bestprecisefile.best" always_nxdomain +local-zone: "tackis.xyz" always_nxdomain local-zone: "talskingest.top" always_nxdomain local-zone: "tastefulwood.xyz" always_nxdomain local-zone: "theable.me" always_nxdomain @@ -422,10 +431,10 @@ local-zone: "thehealthpedia.info" always_nxdomain local-zone: "thehealthystyle.info" always_nxdomain local-zone: "thehealthyvibe.info" always_nxdomain local-zone: "thehotshot.info" always_nxdomain -local-zone: "thelastpicture.show" always_nxdomain local-zone: "thenewjourney.info" always_nxdomain local-zone: "thepackage.club" always_nxdomain local-zone: "thesafestplayerlinks.work" always_nxdomain +local-zone: "theslotomania.info" always_nxdomain local-zone: "thestablealwayssafeupdates.work" always_nxdomain local-zone: "thestablegreatupdates.work" always_nxdomain local-zone: "thestablegreatupgrades.best" always_nxdomain @@ -460,6 +469,7 @@ local-zone: "vpntool.me" always_nxdomain local-zone: "website4all.info" always_nxdomain local-zone: "websiteforall.work" always_nxdomain local-zone: "websitetoget.work" always_nxdomain +local-zone: "webtip.co" always_nxdomain local-zone: "wellnessgram.info" always_nxdomain local-zone: "wellnessplum.info" always_nxdomain local-zone: "wherentlybrane.site" always_nxdomain diff --git a/dist/pup-filter-vivaldi.txt b/dist/pup-filter-vivaldi.txt index 33ebf0e..7aec20d 100644 --- a/dist/pup-filter-vivaldi.txt +++ b/dist/pup-filter-vivaldi.txt @@ -1,6 +1,6 @@ ! Title: PUP Domains Blocklist (Vivaldi) ! Description: Block domains that host potentially unwanted programs (PUP) -! Updated: Tue, 06 Apr 2021 00:07:15 UTC +! Updated: Tue, 06 Apr 2021 12:08:24 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/pup-filter ! License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ ||123news.website$document ||20patogh.com$document ||321movies.xyz$document -||4uabs.club$document ||7awwa2.xyz$document +||abcscience.xyz$document ||abeah-security.xyz$document ||adrondespi.top$document ||advancecare.info$document ||akb48wrapup.com$document ||amateurxporn.com$document +||animenation.org$document ||apptool.me$document ||ashtdi.cn$document ||assuredhealth.info$document @@ -37,10 +38,10 @@ ||bodyamaze.club$document ||bodyselfcare.info$document ||browsercheck.site$document +||btcinvesting.info$document ||bulley.shop$document ||cabins-r-us.com$document ||calculateprint.xyz$document -||care-connection.info$document ||carebility.info$document ||carevision.info$document ||celebseven.com$document @@ -81,6 +82,7 @@ ||filmrod.xyz$document ||films-down.com$document ||financial-deals.xyz$document +||findforus.net$document ||findoffers.co$document ||findperfectplaces4download.work$document ||findyourultimateplayersfirst.best$document @@ -132,11 +134,13 @@ ||gramp.xyz$document ||grandcasinoprize.info$document ||greatplaceofstubs.work$document +||greatsearch.xyz$document ||growthnetic.club$document ||hailso.xyz$document ||haircarepro.info$document ||happyactive.today$document ||happymakeworld.xyz$document +||healandgrow.club$document ||healthdefine.info$document ||healthdome.info$document ||healtheezy.info$document @@ -223,6 +227,7 @@ ||meeryslotspin.xyz$document ||merryplayglobal.xyz$document ||merryplayworld.xyz$document +||mindbank.ai$document ||mindmatch.ai$document ||mistraffic.me$document ||modern-security.xyz$document @@ -233,6 +238,7 @@ ||nosyknot.xyz$document ||nutrinamic.info$document ||onegowc.pw$document +||onlinecinema.eu$document ||operatecompletely-theprecisefile.best$document ||operatecompletely-thespeedyfile.best$document ||operateextremely-theprogressivefile.best$document @@ -289,6 +295,7 @@ ||performuber-theoriginalfile.best$document ||performuber-therenewedfile.best$document ||piorkeepi.top$document +||placesiteb.xyz$document ||placesitee.xyz$document ||placewebe.xyz$document ||plampo.xyz$document @@ -299,6 +306,7 @@ ||preparedforsafeupgrading.work$document ||primawise.info$document ||primecare.today$document +||productiq.net$document ||prohealthroutine.info$document ||protect-connection.com$document ||protectyourvpn.com$document @@ -406,6 +414,7 @@ ||syncrenewed-bestcompletelyfile.best$document ||syncuber-bestoriginalfile.best$document ||syncuber-bestprecisefile.best$document +||tackis.xyz$document ||talskingest.top$document ||tastefulwood.xyz$document ||theable.me$document @@ -422,10 +431,10 @@ ||thehealthystyle.info$document ||thehealthyvibe.info$document ||thehotshot.info$document -||thelastpicture.show$document ||thenewjourney.info$document ||thepackage.club$document ||thesafestplayerlinks.work$document +||theslotomania.info$document ||thestablealwayssafeupdates.work$document ||thestablegreatupdates.work$document ||thestablegreatupgrades.best$document @@ -460,6 +469,7 @@ ||website4all.info$document ||websiteforall.work$document ||websitetoget.work$document +||webtip.co$document ||wellnessgram.info$document ||wellnessplum.info$document ||wherentlybrane.site$document diff --git a/dist/pup-filter.tpl b/dist/pup-filter.tpl index 74c700c..73be909 100644 --- a/dist/pup-filter.tpl +++ b/dist/pup-filter.tpl @@ -1,7 +1,7 @@ msFilterList # Title: PUP Hosts Blocklist (IE) # Description: Block domains that host potentially unwanted programs (PUP) -# Updated: Tue, 06 Apr 2021 00:07:15 UTC +# Updated: Tue, 06 Apr 2021 12:08:24 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/pup-filter # License: https://gitlab.com/curben/pup-filter#license @@ -11,13 +11,14 @@ msFilterList -d 123news.website -d 20patogh.com -d 321movies.xyz --d 4uabs.club -d 7awwa2.xyz +-d abcscience.xyz -d abeah-security.xyz -d adrondespi.top -d advancecare.info -d akb48wrapup.com -d amateurxporn.com +-d animenation.org -d apptool.me -d ashtdi.cn -d assuredhealth.info @@ -40,10 +41,10 @@ msFilterList -d bodyamaze.club -d bodyselfcare.info -d browsercheck.site +-d btcinvesting.info -d bulley.shop -d cabins-r-us.com -d calculateprint.xyz --d care-connection.info -d carebility.info -d carevision.info -d celebseven.com @@ -84,6 +85,7 @@ msFilterList -d filmrod.xyz -d films-down.com -d financial-deals.xyz +-d findforus.net -d findoffers.co -d findperfectplaces4download.work -d findyourultimateplayersfirst.best @@ -135,11 +137,13 @@ msFilterList -d gramp.xyz -d grandcasinoprize.info -d greatplaceofstubs.work +-d greatsearch.xyz -d growthnetic.club -d hailso.xyz -d haircarepro.info -d happyactive.today -d happymakeworld.xyz +-d healandgrow.club -d healthdefine.info -d healthdome.info -d healtheezy.info @@ -226,6 +230,7 @@ msFilterList -d meeryslotspin.xyz -d merryplayglobal.xyz -d merryplayworld.xyz +-d mindbank.ai -d mindmatch.ai -d mistraffic.me -d modern-security.xyz @@ -236,6 +241,7 @@ msFilterList -d nosyknot.xyz -d nutrinamic.info -d onegowc.pw +-d onlinecinema.eu -d operatecompletely-theprecisefile.best -d operatecompletely-thespeedyfile.best -d operateextremely-theprogressivefile.best @@ -292,6 +298,7 @@ msFilterList -d performuber-theoriginalfile.best -d performuber-therenewedfile.best -d piorkeepi.top +-d placesiteb.xyz -d placesitee.xyz -d placewebe.xyz -d plampo.xyz @@ -302,6 +309,7 @@ msFilterList -d preparedforsafeupgrading.work -d primawise.info -d primecare.today +-d productiq.net -d prohealthroutine.info -d protect-connection.com -d protectyourvpn.com @@ -409,6 +417,7 @@ msFilterList -d syncrenewed-bestcompletelyfile.best -d syncuber-bestoriginalfile.best -d syncuber-bestprecisefile.best +-d tackis.xyz -d talskingest.top -d tastefulwood.xyz -d theable.me @@ -425,10 +434,10 @@ msFilterList -d thehealthystyle.info -d thehealthyvibe.info -d thehotshot.info --d thelastpicture.show -d thenewjourney.info -d thepackage.club -d thesafestplayerlinks.work +-d theslotomania.info -d thestablealwayssafeupdates.work -d thestablegreatupdates.work -d thestablegreatupgrades.best @@ -463,6 +472,7 @@ msFilterList -d website4all.info -d websiteforall.work -d websitetoget.work +-d webtip.co -d wellnessgram.info -d wellnessplum.info -d wherentlybrane.site diff --git a/dist/pup-filter.txt b/dist/pup-filter.txt index d922356..6899890 100644 --- a/dist/pup-filter.txt +++ b/dist/pup-filter.txt @@ -1,6 +1,6 @@ ! Title: PUP Domains Blocklist ! Description: Block domains that host potentially unwanted programs (PUP) -! Updated: Tue, 06 Apr 2021 00:07:15 UTC +! Updated: Tue, 06 Apr 2021 12:08:24 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/pup-filter ! License: https://gitlab.com/curben/pup-filter#license @@ -8,13 +8,14 @@ 123news.website 20patogh.com 321movies.xyz -4uabs.club 7awwa2.xyz +abcscience.xyz abeah-security.xyz adrondespi.top advancecare.info akb48wrapup.com amateurxporn.com +animenation.org apptool.me ashtdi.cn assuredhealth.info @@ -37,10 +38,10 @@ biztherapy.info bodyamaze.club bodyselfcare.info browsercheck.site +btcinvesting.info bulley.shop cabins-r-us.com calculateprint.xyz -care-connection.info carebility.info carevision.info celebseven.com @@ -81,6 +82,7 @@ filmesonlineturbo.net filmrod.xyz films-down.com financial-deals.xyz +findforus.net findoffers.co findperfectplaces4download.work findyourultimateplayersfirst.best @@ -132,11 +134,13 @@ graburprize.net gramp.xyz grandcasinoprize.info greatplaceofstubs.work +greatsearch.xyz growthnetic.club hailso.xyz haircarepro.info happyactive.today happymakeworld.xyz +healandgrow.club healthdefine.info healthdome.info healtheezy.info @@ -223,6 +227,7 @@ medsjournal.info meeryslotspin.xyz merryplayglobal.xyz merryplayworld.xyz +mindbank.ai mindmatch.ai mistraffic.me modern-security.xyz @@ -233,6 +238,7 @@ nogfw.pro nosyknot.xyz nutrinamic.info onegowc.pw +onlinecinema.eu operatecompletely-theprecisefile.best operatecompletely-thespeedyfile.best operateextremely-theprogressivefile.best @@ -289,6 +295,7 @@ performspeedy-thegreatlyfile.best performuber-theoriginalfile.best performuber-therenewedfile.best piorkeepi.top +placesiteb.xyz placesitee.xyz placewebe.xyz plampo.xyz @@ -299,6 +306,7 @@ premiernursingacademy.org preparedforsafeupgrading.work primawise.info primecare.today +productiq.net prohealthroutine.info protect-connection.com protectyourvpn.com @@ -406,6 +414,7 @@ syncprogressive-besthighlyfile.best syncrenewed-bestcompletelyfile.best syncuber-bestoriginalfile.best syncuber-bestprecisefile.best +tackis.xyz talskingest.top tastefulwood.xyz theable.me @@ -422,10 +431,10 @@ thehealthpedia.info thehealthystyle.info thehealthyvibe.info thehotshot.info -thelastpicture.show thenewjourney.info thepackage.club thesafestplayerlinks.work +theslotomania.info thestablealwayssafeupdates.work thestablegreatupdates.work thestablegreatupgrades.best @@ -460,6 +469,7 @@ vpntool.me website4all.info websiteforall.work websitetoget.work +webtip.co wellnessgram.info wellnessplum.info wherentlybrane.site