curben
/
pup-filter
mirror of https://gitlab.com/malware-filter/pup-filter.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Filter updated: Wed, 26 May 2021 00:07:00 UTC

This commit is contained in:
curben-bot 2021-05-26 00:07:00 +00:00
parent de422877fa
commit 35314a9a32
14 changed files with 1233 additions and 1177 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
dist/pup-filter-ag.txt vendored
View File

@ -1,6 +1,6 @@
! Title: PUP Domains Blocklist (AdGuard)
! Description: Block domains that host potentially unwanted programs (PUP)
! Updated: Tue, 25 May 2021 12:06:53 UTC
! Updated: Wed, 26 May 2021 00:07:00 UTC
! Expires: 1 day (update frequency)
! Homepage: https://gitlab.com/curben/pup-filter
! License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@
||altcasino.info$all
||amateurxporn.com$all
||amobil.online$all
||animenation.org$all
||apptool.me$all
||ashtdi.cn$all
||assuredhealth.info$all
@ -176,7 +177,6 @@
||gladvideo.site$all
||gladvideo.surf$all
||gladvideo.website$all
||global-info.space$all
||globalvideo.fun$all
||globalvideo.store$all
||go-x34n7wbcoes-ok.live$all
@ -226,7 +226,6 @@
||healthysure.info$all
||httqzq.vip$all
||idtheft-alert.xyz$all
||iketo.diet$all
||inappropriate.top$all
||information.casa$all
||instablog.club$all
@ -262,6 +261,7 @@
||livingmighty.club$all
||loaddevelopeduberfile.digital$all
||loadfree-bestheavilyfile.best$all
||loadfreeextremelyfile.digital$all
||loadgreatly-bestadvancedfile.best$all
||loadgreatly-bestquickfile.best$all
||loadgreatly-bestrenewedfile.best$all
@ -402,12 +402,12 @@
||primawise.info$all
||primecare.today$all
||privacykeeper.net$all
||productiq.net$all
||prohealthroutine.info$all
||protect-connection.com$all
||protecttool.me$all
||protectyourvpn.com$all
||provpnservice.me$all
||quantum.work$all
||quickdeals.online$all
||rainlonginsect23.life$all
||random-prize-bigwin-official.cyou$all
||randomprizebigwinofficial.cyou$all
@ -475,6 +475,7 @@
||shkshk.site$all
||shopnsave.world$all
||shoppingexp.xyz$all
||signupandturnyourscreenoffsafepowernow.date$all
||spotplanetc.xyz$all
||spotplanetd.xyz$all
||spotspinb.xyz$all
@ -511,6 +512,7 @@
||streamlatest-bestoverlyfile.best$all
||streamquick-bestmostfile.best$all
||streamrecent-bestintenselyfile.best$all
||studentslearnintogether.club$all
||styleandhealth.info$all
||subeamy.pw$all
||sudoo.net$all
@ -565,7 +567,6 @@
||thehealthystyle.info$all
||thehealthyvibe.info$all
||thehotshot.info$all
||thelastpicture.show$all
||thenewjourney.info$all
||thepackage.club$all
||thesafestplayerlinks.work$all
@ -579,6 +580,7 @@
||topnotchsports.tips$all
||trafficbounce.net$all
||trafficgate.cc$all
||trafficmind.pro$all
||trane.fun$all
||trktraf.club$all
||tryoneshot-keto.net$all
@ -609,6 +611,8 @@
||vpntool.me$all
||vpnupdatesnow.com$all
||watchadvanced-bestgreatlyfile.best$all
||watchgreatly-bestcurrentfile.best$all
||watchlatest-bestgreatlyfile.best$all
||website4all.info$all
||websiteforall.work$all
||websitetoget.work$all

16
dist/pup-filter-agh.txt vendored
View File

@ -1,6 +1,6 @@
! Title: PUP Domains Blocklist (AdGuard Home)
! Description: Block domains that host potentially unwanted programs (PUP)
! Updated: Tue, 25 May 2021 12:06:53 UTC
! Updated: Wed, 26 May 2021 00:07:00 UTC
! Expires: 1 day (update frequency)
! Homepage: https://gitlab.com/curben/pup-filter
! License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@
||altcasino.info^
||amateurxporn.com^
||amobil.online^
||animenation.org^
||apptool.me^
||ashtdi.cn^
||assuredhealth.info^
@ -176,7 +177,6 @@
||gladvideo.site^
||gladvideo.surf^
||gladvideo.website^
||global-info.space^
||globalvideo.fun^
||globalvideo.store^
||go-x34n7wbcoes-ok.live^
@ -226,7 +226,6 @@
||healthysure.info^
||httqzq.vip^
||idtheft-alert.xyz^
||iketo.diet^
||inappropriate.top^
||information.casa^
||instablog.club^
@ -262,6 +261,7 @@
||livingmighty.club^
||loaddevelopeduberfile.digital^
||loadfree-bestheavilyfile.best^
||loadfreeextremelyfile.digital^
||loadgreatly-bestadvancedfile.best^
||loadgreatly-bestquickfile.best^
||loadgreatly-bestrenewedfile.best^
@ -402,12 +402,12 @@
||primawise.info^
||primecare.today^
||privacykeeper.net^
||productiq.net^
||prohealthroutine.info^
||protect-connection.com^
||protecttool.me^
||protectyourvpn.com^
||provpnservice.me^
||quantum.work^
||quickdeals.online^
||rainlonginsect23.life^
||random-prize-bigwin-official.cyou^
||randomprizebigwinofficial.cyou^
@ -475,6 +475,7 @@
||shkshk.site^
||shopnsave.world^
||shoppingexp.xyz^
||signupandturnyourscreenoffsafepowernow.date^
||spotplanetc.xyz^
||spotplanetd.xyz^
||spotspinb.xyz^
@ -511,6 +512,7 @@
||streamlatest-bestoverlyfile.best^
||streamquick-bestmostfile.best^
||streamrecent-bestintenselyfile.best^
||studentslearnintogether.club^
||styleandhealth.info^
||subeamy.pw^
||sudoo.net^
@ -565,7 +567,6 @@
||thehealthystyle.info^
||thehealthyvibe.info^
||thehotshot.info^
||thelastpicture.show^
||thenewjourney.info^
||thepackage.club^
||thesafestplayerlinks.work^
@ -579,6 +580,7 @@
||topnotchsports.tips^
||trafficbounce.net^
||trafficgate.cc^
||trafficmind.pro^
||trane.fun^
||trktraf.club^
||tryoneshot-keto.net^
@ -609,6 +611,8 @@
||vpntool.me^
||vpnupdatesnow.com^
||watchadvanced-bestgreatlyfile.best^
||watchgreatly-bestcurrentfile.best^
||watchlatest-bestgreatlyfile.best^
||website4all.info^
||websiteforall.work^
||websitetoget.work^

16
dist/pup-filter-bind.conf vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains BIND Blocklist
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@ zone "akb48wrapup.com" { type master; notify no; file "null.zone.file"; };
zone "altcasino.info" { type master; notify no; file "null.zone.file"; };
zone "amateurxporn.com" { type master; notify no; file "null.zone.file"; };
zone "amobil.online" { type master; notify no; file "null.zone.file"; };
zone "animenation.org" { type master; notify no; file "null.zone.file"; };
zone "apptool.me" { type master; notify no; file "null.zone.file"; };
zone "ashtdi.cn" { type master; notify no; file "null.zone.file"; };
zone "assuredhealth.info" { type master; notify no; file "null.zone.file"; };
@ -176,7 +177,6 @@ zone "gladvideo.online" { type master; notify no; file "null.zone.file"; };
zone "gladvideo.site" { type master; notify no; file "null.zone.file"; };
zone "gladvideo.surf" { type master; notify no; file "null.zone.file"; };
zone "gladvideo.website" { type master; notify no; file "null.zone.file"; };
zone "global-info.space" { type master; notify no; file "null.zone.file"; };
zone "globalvideo.fun" { type master; notify no; file "null.zone.file"; };
zone "globalvideo.store" { type master; notify no; file "null.zone.file"; };
zone "go-x34n7wbcoes-ok.live" { type master; notify no; file "null.zone.file"; };
@ -226,7 +226,6 @@ zone "healthyspirit.info" { type master; notify no; file "null.zone.file"; };
zone "healthysure.info" { type master; notify no; file "null.zone.file"; };
zone "httqzq.vip" { type master; notify no; file "null.zone.file"; };
zone "idtheft-alert.xyz" { type master; notify no; file "null.zone.file"; };
zone "iketo.diet" { type master; notify no; file "null.zone.file"; };
zone "inappropriate.top" { type master; notify no; file "null.zone.file"; };
zone "information.casa" { type master; notify no; file "null.zone.file"; };
zone "instablog.club" { type master; notify no; file "null.zone.file"; };
@ -262,6 +261,7 @@ zone "livelyyroad.xyz" { type master; notify no; file "null.zone.file"; };
zone "livingmighty.club" { type master; notify no; file "null.zone.file"; };
zone "loaddevelopeduberfile.digital" { type master; notify no; file "null.zone.file"; };
zone "loadfree-bestheavilyfile.best" { type master; notify no; file "null.zone.file"; };
zone "loadfreeextremelyfile.digital" { type master; notify no; file "null.zone.file"; };
zone "loadgreatly-bestadvancedfile.best" { type master; notify no; file "null.zone.file"; };
zone "loadgreatly-bestquickfile.best" { type master; notify no; file "null.zone.file"; };
zone "loadgreatly-bestrenewedfile.best" { type master; notify no; file "null.zone.file"; };
@ -402,12 +402,12 @@ zone "preparedforsafeupgrading.work" { type master; notify no; file "null.zone.f
zone "primawise.info" { type master; notify no; file "null.zone.file"; };
zone "primecare.today" { type master; notify no; file "null.zone.file"; };
zone "privacykeeper.net" { type master; notify no; file "null.zone.file"; };
zone "productiq.net" { type master; notify no; file "null.zone.file"; };
zone "prohealthroutine.info" { type master; notify no; file "null.zone.file"; };
zone "protect-connection.com" { type master; notify no; file "null.zone.file"; };
zone "protecttool.me" { type master; notify no; file "null.zone.file"; };
zone "protectyourvpn.com" { type master; notify no; file "null.zone.file"; };
zone "provpnservice.me" { type master; notify no; file "null.zone.file"; };
zone "quantum.work" { type master; notify no; file "null.zone.file"; };
zone "quickdeals.online" { type master; notify no; file "null.zone.file"; };
zone "rainlonginsect23.life" { type master; notify no; file "null.zone.file"; };
zone "random-prize-bigwin-official.cyou" { type master; notify no; file "null.zone.file"; };
zone "randomprizebigwinofficial.cyou" { type master; notify no; file "null.zone.file"; };
@ -475,6 +475,7 @@ zone "service-care.space" { type master; notify no; file "null.zone.file"; };
zone "shkshk.site" { type master; notify no; file "null.zone.file"; };
zone "shopnsave.world" { type master; notify no; file "null.zone.file"; };
zone "shoppingexp.xyz" { type master; notify no; file "null.zone.file"; };
zone "signupandturnyourscreenoffsafepowernow.date" { type master; notify no; file "null.zone.file"; };
zone "spotplanetc.xyz" { type master; notify no; file "null.zone.file"; };
zone "spotplanetd.xyz" { type master; notify no; file "null.zone.file"; };
zone "spotspinb.xyz" { type master; notify no; file "null.zone.file"; };
@ -511,6 +512,7 @@ zone "streamlatest-bestextremelyfile.best" { type master; notify no; file "null.
zone "streamlatest-bestoverlyfile.best" { type master; notify no; file "null.zone.file"; };
zone "streamquick-bestmostfile.best" { type master; notify no; file "null.zone.file"; };
zone "streamrecent-bestintenselyfile.best" { type master; notify no; file "null.zone.file"; };
zone "studentslearnintogether.club" { type master; notify no; file "null.zone.file"; };
zone "styleandhealth.info" { type master; notify no; file "null.zone.file"; };
zone "subeamy.pw" { type master; notify no; file "null.zone.file"; };
zone "sudoo.net" { type master; notify no; file "null.zone.file"; };
@ -565,7 +567,6 @@ zone "thehealthpedia.info" { type master; notify no; file "null.zone.file"; };
zone "thehealthystyle.info" { type master; notify no; file "null.zone.file"; };
zone "thehealthyvibe.info" { type master; notify no; file "null.zone.file"; };
zone "thehotshot.info" { type master; notify no; file "null.zone.file"; };
zone "thelastpicture.show" { type master; notify no; file "null.zone.file"; };
zone "thenewjourney.info" { type master; notify no; file "null.zone.file"; };
zone "thepackage.club" { type master; notify no; file "null.zone.file"; };
zone "thesafestplayerlinks.work" { type master; notify no; file "null.zone.file"; };
@ -579,6 +580,7 @@ zone "toovolution.club" { type master; notify no; file "null.zone.file"; };
zone "topnotchsports.tips" { type master; notify no; file "null.zone.file"; };
zone "trafficbounce.net" { type master; notify no; file "null.zone.file"; };
zone "trafficgate.cc" { type master; notify no; file "null.zone.file"; };
zone "trafficmind.pro" { type master; notify no; file "null.zone.file"; };
zone "trane.fun" { type master; notify no; file "null.zone.file"; };
zone "trktraf.club" { type master; notify no; file "null.zone.file"; };
zone "tryoneshot-keto.net" { type master; notify no; file "null.zone.file"; };
@ -609,6 +611,8 @@ zone "vpnservice.me" { type master; notify no; file "null.zone.file"; };
zone "vpntool.me" { type master; notify no; file "null.zone.file"; };
zone "vpnupdatesnow.com" { type master; notify no; file "null.zone.file"; };
zone "watchadvanced-bestgreatlyfile.best" { type master; notify no; file "null.zone.file"; };
zone "watchgreatly-bestcurrentfile.best" { type master; notify no; file "null.zone.file"; };
zone "watchlatest-bestgreatlyfile.best" { type master; notify no; file "null.zone.file"; };
zone "website4all.info" { type master; notify no; file "null.zone.file"; };
zone "websiteforall.work" { type master; notify no; file "null.zone.file"; };
zone "websitetoget.work" { type master; notify no; file "null.zone.file"; };

16
dist/pup-filter-dnsmasq.conf vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains dnsmasq Blocklist
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@ address=/akb48wrapup.com/0.0.0.0
address=/altcasino.info/0.0.0.0
address=/amateurxporn.com/0.0.0.0
address=/amobil.online/0.0.0.0
address=/animenation.org/0.0.0.0
address=/apptool.me/0.0.0.0
address=/ashtdi.cn/0.0.0.0
address=/assuredhealth.info/0.0.0.0
@ -176,7 +177,6 @@ address=/gladvideo.online/0.0.0.0
address=/gladvideo.site/0.0.0.0
address=/gladvideo.surf/0.0.0.0
address=/gladvideo.website/0.0.0.0
address=/global-info.space/0.0.0.0
address=/globalvideo.fun/0.0.0.0
address=/globalvideo.store/0.0.0.0
address=/go-x34n7wbcoes-ok.live/0.0.0.0
@ -226,7 +226,6 @@ address=/healthyspirit.info/0.0.0.0
address=/healthysure.info/0.0.0.0
address=/httqzq.vip/0.0.0.0
address=/idtheft-alert.xyz/0.0.0.0
address=/iketo.diet/0.0.0.0
address=/inappropriate.top/0.0.0.0
address=/information.casa/0.0.0.0
address=/instablog.club/0.0.0.0
@ -262,6 +261,7 @@ address=/livelyyroad.xyz/0.0.0.0
address=/livingmighty.club/0.0.0.0
address=/loaddevelopeduberfile.digital/0.0.0.0
address=/loadfree-bestheavilyfile.best/0.0.0.0
address=/loadfreeextremelyfile.digital/0.0.0.0
address=/loadgreatly-bestadvancedfile.best/0.0.0.0
address=/loadgreatly-bestquickfile.best/0.0.0.0
address=/loadgreatly-bestrenewedfile.best/0.0.0.0
@ -402,12 +402,12 @@ address=/preparedforsafeupgrading.work/0.0.0.0
address=/primawise.info/0.0.0.0
address=/primecare.today/0.0.0.0
address=/privacykeeper.net/0.0.0.0
address=/productiq.net/0.0.0.0
address=/prohealthroutine.info/0.0.0.0
address=/protect-connection.com/0.0.0.0
address=/protecttool.me/0.0.0.0
address=/protectyourvpn.com/0.0.0.0
address=/provpnservice.me/0.0.0.0
address=/quantum.work/0.0.0.0
address=/quickdeals.online/0.0.0.0
address=/rainlonginsect23.life/0.0.0.0
address=/random-prize-bigwin-official.cyou/0.0.0.0
address=/randomprizebigwinofficial.cyou/0.0.0.0
@ -475,6 +475,7 @@ address=/service-care.space/0.0.0.0
address=/shkshk.site/0.0.0.0
address=/shopnsave.world/0.0.0.0
address=/shoppingexp.xyz/0.0.0.0
address=/signupandturnyourscreenoffsafepowernow.date/0.0.0.0
address=/spotplanetc.xyz/0.0.0.0
address=/spotplanetd.xyz/0.0.0.0
address=/spotspinb.xyz/0.0.0.0
@ -511,6 +512,7 @@ address=/streamlatest-bestextremelyfile.best/0.0.0.0
address=/streamlatest-bestoverlyfile.best/0.0.0.0
address=/streamquick-bestmostfile.best/0.0.0.0
address=/streamrecent-bestintenselyfile.best/0.0.0.0
address=/studentslearnintogether.club/0.0.0.0
address=/styleandhealth.info/0.0.0.0
address=/subeamy.pw/0.0.0.0
address=/sudoo.net/0.0.0.0
@ -565,7 +567,6 @@ address=/thehealthpedia.info/0.0.0.0
address=/thehealthystyle.info/0.0.0.0
address=/thehealthyvibe.info/0.0.0.0
address=/thehotshot.info/0.0.0.0
address=/thelastpicture.show/0.0.0.0
address=/thenewjourney.info/0.0.0.0
address=/thepackage.club/0.0.0.0
address=/thesafestplayerlinks.work/0.0.0.0
@ -579,6 +580,7 @@ address=/toovolution.club/0.0.0.0
address=/topnotchsports.tips/0.0.0.0
address=/trafficbounce.net/0.0.0.0
address=/trafficgate.cc/0.0.0.0
address=/trafficmind.pro/0.0.0.0
address=/trane.fun/0.0.0.0
address=/trktraf.club/0.0.0.0
address=/tryoneshot-keto.net/0.0.0.0
@ -609,6 +611,8 @@ address=/vpnservice.me/0.0.0.0
address=/vpntool.me/0.0.0.0
address=/vpnupdatesnow.com/0.0.0.0
address=/watchadvanced-bestgreatlyfile.best/0.0.0.0
address=/watchgreatly-bestcurrentfile.best/0.0.0.0
address=/watchlatest-bestgreatlyfile.best/0.0.0.0
address=/website4all.info/0.0.0.0
address=/websiteforall.work/0.0.0.0
address=/websitetoget.work/0.0.0.0

16
dist/pup-filter-domains.txt vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains Blocklist
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@ akb48wrapup.com
altcasino.info
amateurxporn.com
amobil.online
animenation.org
apptool.me
ashtdi.cn
assuredhealth.info
@ -176,7 +177,6 @@ gladvideo.online
gladvideo.site
gladvideo.surf
gladvideo.website
global-info.space
globalvideo.fun
globalvideo.store
go-x34n7wbcoes-ok.live
@ -226,7 +226,6 @@ healthyspirit.info
healthysure.info
httqzq.vip
idtheft-alert.xyz
iketo.diet
inappropriate.top
information.casa
instablog.club
@ -262,6 +261,7 @@ livelyyroad.xyz
livingmighty.club
loaddevelopeduberfile.digital
loadfree-bestheavilyfile.best
loadfreeextremelyfile.digital
loadgreatly-bestadvancedfile.best
loadgreatly-bestquickfile.best
loadgreatly-bestrenewedfile.best
@ -402,12 +402,12 @@ preparedforsafeupgrading.work
primawise.info
primecare.today
privacykeeper.net
productiq.net
prohealthroutine.info
protect-connection.com
protecttool.me
protectyourvpn.com
provpnservice.me
quantum.work
quickdeals.online
rainlonginsect23.life
random-prize-bigwin-official.cyou
randomprizebigwinofficial.cyou
@ -475,6 +475,7 @@ service-care.space
shkshk.site
shopnsave.world
shoppingexp.xyz
signupandturnyourscreenoffsafepowernow.date
spotplanetc.xyz
spotplanetd.xyz
spotspinb.xyz
@ -511,6 +512,7 @@ streamlatest-bestextremelyfile.best
streamlatest-bestoverlyfile.best
streamquick-bestmostfile.best
streamrecent-bestintenselyfile.best
studentslearnintogether.club
styleandhealth.info
subeamy.pw
sudoo.net
@ -565,7 +567,6 @@ thehealthpedia.info
thehealthystyle.info
thehealthyvibe.info
thehotshot.info
thelastpicture.show
thenewjourney.info
thepackage.club
thesafestplayerlinks.work
@ -579,6 +580,7 @@ toovolution.club
topnotchsports.tips
trafficbounce.net
trafficgate.cc
trafficmind.pro
trane.fun
trktraf.club
tryoneshot-keto.net
@ -609,6 +611,8 @@ vpnservice.me
vpntool.me
vpnupdatesnow.com
watchadvanced-bestgreatlyfile.best
watchgreatly-bestcurrentfile.best
watchlatest-bestgreatlyfile.best
website4all.info
websiteforall.work
websitetoget.work

16
dist/pup-filter-hosts.txt vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Hosts Blocklist
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@
0.0.0.0 altcasino.info
0.0.0.0 amateurxporn.com
0.0.0.0 amobil.online
0.0.0.0 animenation.org
0.0.0.0 apptool.me
0.0.0.0 ashtdi.cn
0.0.0.0 assuredhealth.info
@ -176,7 +177,6 @@
0.0.0.0 gladvideo.site
0.0.0.0 gladvideo.surf
0.0.0.0 gladvideo.website
0.0.0.0 global-info.space
0.0.0.0 globalvideo.fun
0.0.0.0 globalvideo.store
0.0.0.0 go-x34n7wbcoes-ok.live
@ -226,7 +226,6 @@
0.0.0.0 healthysure.info
0.0.0.0 httqzq.vip
0.0.0.0 idtheft-alert.xyz
0.0.0.0 iketo.diet
0.0.0.0 inappropriate.top
0.0.0.0 information.casa
0.0.0.0 instablog.club
@ -262,6 +261,7 @@
0.0.0.0 livingmighty.club
0.0.0.0 loaddevelopeduberfile.digital
0.0.0.0 loadfree-bestheavilyfile.best
0.0.0.0 loadfreeextremelyfile.digital
0.0.0.0 loadgreatly-bestadvancedfile.best
0.0.0.0 loadgreatly-bestquickfile.best
0.0.0.0 loadgreatly-bestrenewedfile.best
@ -402,12 +402,12 @@
0.0.0.0 primawise.info
0.0.0.0 primecare.today
0.0.0.0 privacykeeper.net
0.0.0.0 productiq.net
0.0.0.0 prohealthroutine.info
0.0.0.0 protect-connection.com
0.0.0.0 protecttool.me
0.0.0.0 protectyourvpn.com
0.0.0.0 provpnservice.me
0.0.0.0 quantum.work
0.0.0.0 quickdeals.online
0.0.0.0 rainlonginsect23.life
0.0.0.0 random-prize-bigwin-official.cyou
0.0.0.0 randomprizebigwinofficial.cyou
@ -475,6 +475,7 @@
0.0.0.0 shkshk.site
0.0.0.0 shopnsave.world
0.0.0.0 shoppingexp.xyz
0.0.0.0 signupandturnyourscreenoffsafepowernow.date
0.0.0.0 spotplanetc.xyz
0.0.0.0 spotplanetd.xyz
0.0.0.0 spotspinb.xyz
@ -511,6 +512,7 @@
0.0.0.0 streamlatest-bestoverlyfile.best
0.0.0.0 streamquick-bestmostfile.best
0.0.0.0 streamrecent-bestintenselyfile.best
0.0.0.0 studentslearnintogether.club
0.0.0.0 styleandhealth.info
0.0.0.0 subeamy.pw
0.0.0.0 sudoo.net
@ -565,7 +567,6 @@
0.0.0.0 thehealthystyle.info
0.0.0.0 thehealthyvibe.info
0.0.0.0 thehotshot.info
0.0.0.0 thelastpicture.show
0.0.0.0 thenewjourney.info
0.0.0.0 thepackage.club
0.0.0.0 thesafestplayerlinks.work
@ -579,6 +580,7 @@
0.0.0.0 topnotchsports.tips
0.0.0.0 trafficbounce.net
0.0.0.0 trafficgate.cc
0.0.0.0 trafficmind.pro
0.0.0.0 trane.fun
0.0.0.0 trktraf.club
0.0.0.0 tryoneshot-keto.net
@ -609,6 +611,8 @@
0.0.0.0 vpntool.me
0.0.0.0 vpnupdatesnow.com
0.0.0.0 watchadvanced-bestgreatlyfile.best
0.0.0.0 watchgreatly-bestcurrentfile.best
0.0.0.0 watchlatest-bestgreatlyfile.best
0.0.0.0 website4all.info
0.0.0.0 websiteforall.work
0.0.0.0 websitetoget.work

18
dist/pup-filter-rpz.conf vendored
View File

@ -1,13 +1,13 @@
; Title: PUP Domains RPZ Blocklist
; Description: Block domains that host potentially unwanted programs (PUP)
; Updated: Tue, 25 May 2021 12:06:53 UTC
; Updated: Wed, 26 May 2021 00:07:00 UTC
; Expires: 1 day (update frequency)
; Homepage: https://gitlab.com/curben/pup-filter
; License: https://gitlab.com/curben/pup-filter#license
; Source: https://github.com/zhouhanc/malware-discoverer
$TTL 30
@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1621944413 86400 3600 604800 30
@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1621987620 86400 3600 604800 30
NS localhost.
123news.website CNAME .
@ -23,6 +23,7 @@ akb48wrapup.com CNAME .
altcasino.info CNAME .
amateurxporn.com CNAME .
amobil.online CNAME .
animenation.org CNAME .
apptool.me CNAME .
ashtdi.cn CNAME .
assuredhealth.info CNAME .
@ -181,7 +182,6 @@ gladvideo.online CNAME .
gladvideo.site CNAME .
gladvideo.surf CNAME .
gladvideo.website CNAME .
global-info.space CNAME .
globalvideo.fun CNAME .
globalvideo.store CNAME .
go-x34n7wbcoes-ok.live CNAME .
@ -231,7 +231,6 @@ healthyspirit.info CNAME .
healthysure.info CNAME .
httqzq.vip CNAME .
idtheft-alert.xyz CNAME .
iketo.diet CNAME .
inappropriate.top CNAME .
information.casa CNAME .
instablog.club CNAME .
@ -267,6 +266,7 @@ livelyyroad.xyz CNAME .
livingmighty.club CNAME .
loaddevelopeduberfile.digital CNAME .
loadfree-bestheavilyfile.best CNAME .
loadfreeextremelyfile.digital CNAME .
loadgreatly-bestadvancedfile.best CNAME .
loadgreatly-bestquickfile.best CNAME .
loadgreatly-bestrenewedfile.best CNAME .
@ -407,12 +407,12 @@ preparedforsafeupgrading.work CNAME .
primawise.info CNAME .
primecare.today CNAME .
privacykeeper.net CNAME .
productiq.net CNAME .
prohealthroutine.info CNAME .
protect-connection.com CNAME .
protecttool.me CNAME .
protectyourvpn.com CNAME .
provpnservice.me CNAME .
quantum.work CNAME .
quickdeals.online CNAME .
rainlonginsect23.life CNAME .
random-prize-bigwin-official.cyou CNAME .
randomprizebigwinofficial.cyou CNAME .
@ -480,6 +480,7 @@ service-care.space CNAME .
shkshk.site CNAME .
shopnsave.world CNAME .
shoppingexp.xyz CNAME .
signupandturnyourscreenoffsafepowernow.date CNAME .
spotplanetc.xyz CNAME .
spotplanetd.xyz CNAME .
spotspinb.xyz CNAME .
@ -516,6 +517,7 @@ streamlatest-bestextremelyfile.best CNAME .
streamlatest-bestoverlyfile.best CNAME .
streamquick-bestmostfile.best CNAME .
streamrecent-bestintenselyfile.best CNAME .
studentslearnintogether.club CNAME .
styleandhealth.info CNAME .
subeamy.pw CNAME .
sudoo.net CNAME .
@ -570,7 +572,6 @@ thehealthpedia.info CNAME .
thehealthystyle.info CNAME .
thehealthyvibe.info CNAME .
thehotshot.info CNAME .
thelastpicture.show CNAME .
thenewjourney.info CNAME .
thepackage.club CNAME .
thesafestplayerlinks.work CNAME .
@ -584,6 +585,7 @@ toovolution.club CNAME .
topnotchsports.tips CNAME .
trafficbounce.net CNAME .
trafficgate.cc CNAME .
trafficmind.pro CNAME .
trane.fun CNAME .
trktraf.club CNAME .
tryoneshot-keto.net CNAME .
@ -614,6 +616,8 @@ vpnservice.me CNAME .
vpntool.me CNAME .
vpnupdatesnow.com CNAME .
watchadvanced-bestgreatlyfile.best CNAME .
watchgreatly-bestcurrentfile.best CNAME .
watchlatest-bestgreatlyfile.best CNAME .
website4all.info CNAME .
websiteforall.work CNAME .
websitetoget.work CNAME .

744
dist/pup-filter-snort2.rules vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains Snort2 Ruleset
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,165 +18,165 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website d
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"altcasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"amateurxporn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"amobil.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"apptool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashtdi.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"assuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"asufij.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"auto-lawyer.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"baseofmp3.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestappland.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestresults.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestvideoplayerupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigcbd.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigdaycasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigwin-online-free-congrats.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigwinonlinefreecongrats.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-trader.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinjunction.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bittrend.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"biztherapy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-com.email"; content:"Host"; http_header; classtype:web-application-activity; sid:300000038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyamaze.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyselfcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upcompletely-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upcompletely-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upfree-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upoverly-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-uprefined-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upuber-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"browsercheck.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcinvesting.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulley.shop"; content:"Host"; http_header; classtype:web-application-activity; sid:300000049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabins-r-us.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"calculateprint.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"care-connection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carebility.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerconnecthub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carevision.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"celebseven.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"centrodeartigos.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-your-profitzone.life"; content:"Host"; http_header; classtype:web-application-activity; sid:300000058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheerplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"coachbelief.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"collectrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"comphp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceivecolor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conflaqpzc.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"congrats-lucky-giveaway-smart.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"congratsluckygiveawaysmart.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectionapplication.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.cam"; content:"Host"; http_header; classtype:web-application-activity; sid:300000072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.uno"; content:"Host"; http_header; classtype:web-application-activity; sid:300000075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cooing.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-monitor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-resources.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotilt.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotradingcourses.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptounlimited.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cs-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cselfconnect.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"curesector.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.monster"; content:"Host"; http_header; classtype:web-application-activity; sid:300000088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailyrep.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"degreenm.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"delightcmain.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalinvest.news"; content:"Host"; http_header; classtype:web-application-activity; sid:300000096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"displayfriend.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ditvl.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonballclub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eanswers.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehousan.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eproute.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eroanimeittyokusen.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"erotica.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"excitingthing.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrasafe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-sex.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspota.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspotb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastwebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmesonlineturbo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmrod.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"films-down.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"financial-deals.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findforus.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findoffers.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces2download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces4download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findyourultimateplayersfirst.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"firststableplayer.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisham.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandstable.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitbodyandsoul.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitcourage.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspark.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspot.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitlifevalue.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitnessdial.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flash-rewards.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flatbellylife.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flexroll.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyfreecostas.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"foregoingpump.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"forsalecheap.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"free-gifts.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freshclover.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuck-me-hard.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funsiteb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspinf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funwebd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsxqc.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gainhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gapingshame.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"generouscare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getmoregirls.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getstablesystemupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladdboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladslotweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspaceplane.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotwonder.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"global-info.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"animenation.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"apptool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashtdi.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"assuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"asufij.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"auto-lawyer.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"baseofmp3.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestappland.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestresults.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestvideoplayerupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterfreedownloadplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigcbd.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigdaycasino.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigwin-online-free-congrats.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigwinonlinefreecongrats.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-trader.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinjunction.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bittrend.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"biztherapy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-com.email"; content:"Host"; http_header; classtype:web-application-activity; sid:300000039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyamaze.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodyselfcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upcompletely-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upcompletely-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upfree-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upoverly-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-uprefined-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"boot-upuber-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"browsercheck.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcinvesting.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulley.shop"; content:"Host"; http_header; classtype:web-application-activity; sid:300000050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabins-r-us.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"calculateprint.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"care-connection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carebility.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerconnecthub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"carevision.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"celebseven.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"centrodeartigos.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-your-profitzone.life"; content:"Host"; http_header; classtype:web-application-activity; sid:300000059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheerplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmedia.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"coachbelief.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"collectrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"comphp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceivecolor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"conflaqpzc.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"congrats-lucky-giveaway-smart.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"congratsluckygiveawaysmart.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectionapplication.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.cam"; content:"Host"; http_header; classtype:web-application-activity; sid:300000073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"contentgate.uno"; content:"Host"; http_header; classtype:web-application-activity; sid:300000076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cooing.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-monitor.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-resources.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotilt.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptotradingcourses.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptounlimited.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cs-alerts.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"cselfconnect.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"curesector.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.monster"; content:"Host"; http_header; classtype:web-application-activity; sid:300000089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailymedia.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailyrep.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"degreenm.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"delightcmain.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalinvest.news"; content:"Host"; http_header; classtype:web-application-activity; sid:300000097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"displayfriend.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ditvl.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonballclub.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eanswers.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehousan.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eproute.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"eroanimeittyokusen.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"erotica.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"excitingthing.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrasafe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-sex.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmapf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspota.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastspotb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastwebe.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmesonlineturbo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"filmrod.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"films-down.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"financial-deals.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findforus.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findoffers.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces2download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findperfectplaces4download.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"findyourultimateplayersfirst.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"firststableplayer.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisham.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandready.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitandstable.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitbodyandsoul.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitcourage.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspark.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthspot.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fithealthsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitlifevalue.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitnessdial.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fitsure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flash-rewards.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flatbellylife.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flexroll.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyfreecostas.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"foregoingpump.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"forsalecheap.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"free-gifts.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeperfectupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"freshclover.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuck-me-hard.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funmapd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funsiteb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspinf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"funwebd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsxqc.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gainhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gapingshame.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"generouscare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getmoregirls.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"getstablesystemupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladdboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladplaceweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladslotweb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspaceplane.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladspotwonder.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.surf"; content:"Host"; http_header; classtype:web-application-activity; sid:300000171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"gladvideo.website"; content:"Host"; http_header; classtype:web-application-activity; sid:300000172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalvideo.store"; content:"Host"; http_header; classtype:web-application-activity; sid:300000174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"go-x34n7wbcoes-ok.live"; content:"Host"; http_header; classtype:web-application-activity; sid:300000175; rev:1;)
@ -226,42 +226,42 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website d
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthysure.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"httqzq.vip"; content:"Host"; http_header; classtype:web-application-activity; sid:300000220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"idtheft-alert.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iketo.diet"; content:"Host"; http_header; classtype:web-application-activity; sid:300000222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"inappropriate.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"information.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"instablog.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"installcompletely-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"insuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosdfnc.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosrecommendedvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosvpnsecure.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"izipik.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"java-forum.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyplaceplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotmap.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrenthouse.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jubilantdstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"kad3md.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepithealthy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketodietrecipes.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"leeching.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplayerupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendarysiteupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"life-esteem.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifecaregoal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightstop.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livehealthcare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livelyyroad.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livingmighty.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loaddevelopeduberfile.digital"; content:"Host"; http_header; classtype:web-application-activity; sid:300000256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadfree-bestheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"inappropriate.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"information.casa"; content:"Host"; http_header; classtype:web-application-activity; sid:300000223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"instablog.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"installcompletely-theoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"insuredhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosdfnc.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosrecommendedvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosvpnsecure.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"izipik.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"java-forum.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyplaceplay.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotmap.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"joyspotspin.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrenthouse.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"jubilantdstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"kad3md.cn"; content:"Host"; http_header; classtype:web-application-activity; sid:300000237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepithealthy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketodietrecipes.org"; content:"Host"; http_header; classtype:web-application-activity; sid:300000239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"leeching.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplaceupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryplayerupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendarysiteupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"legendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"life-esteem.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifecaregoal.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightstop.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livehealthcare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livelyyroad.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"livingmighty.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loaddevelopeduberfile.digital"; content:"Host"; http_header; classtype:web-application-activity; sid:300000255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadfree-bestheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadfreeextremelyfile.digital"; content:"Host"; http_header; classtype:web-application-activity; sid:300000257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"loadgreatly-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000260; rev:1;)
@ -402,12 +402,12 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website d
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primawise.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"primecare.today"; content:"Host"; http_header; classtype:web-application-activity; sid:300000396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"privacykeeper.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"productiq.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"prohealthroutine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-connection.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"prohealthroutine.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-connection.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protecttool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"protectyourvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"quantum.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickdeals.online"; content:"Host"; http_header; classtype:web-application-activity; sid:300000403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"provpnservice.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"quantum.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"rainlonginsect23.life"; content:"Host"; http_header; classtype:web-application-activity; sid:300000404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"random-prize-bigwin-official.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"randomprizebigwinofficial.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000406; rev:1;)
@ -475,172 +475,176 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website d
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shkshk.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopnsave.world"; content:"Host"; http_header; classtype:web-application-activity; sid:300000469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"shoppingexp.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspinb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitea.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitef.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stay-notified.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stingyscent.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storelatest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenewest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-theadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storerecent-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storespeedy-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeswift-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamadvanced-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamadvanced-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamextremely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamextremely-bestnewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamfree-bestmostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestcurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamlatest-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamlatest-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamquick-bestmostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamrecent-bestintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleandhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"subeamy.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sudoo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sugar-legal-about13.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superiorcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplace4upgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplace4upgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplaceforupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superpromotion.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-notify.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-club.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-review.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncadvanced-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncgreatly-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncheavily-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncintensely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synclatest-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncoriginal-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncrenewed-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncstrong-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestrefinedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"talskingest.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tastefulwood.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdstraffic.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theable.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theconnectvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecryptomoney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefatburner.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefitproject.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcurve.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcycle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthgo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthpedia.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthystyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthyvibe.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehotshot.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thelastpicture.show"; content:"Host"; http_header; classtype:web-application-activity; sid:300000561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenewjourney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepackage.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestplayerlinks.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theslotomania.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablealwayssafeupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupgrades.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thrillqueen.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"toovolution.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"topnotchsports.tips"; content:"Host"; http_header; classtype:web-application-activity; sid:300000572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficbounce.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficgate.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trane.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trktraf.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tryoneshot-keto.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uclaimrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unequalfaucet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniremedy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitehealth.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmway.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecurrent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatelatest-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updaterecent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmakesite.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vexearth.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viral-surveys.win"; content:"Host"; http_header; classtype:web-application-activity; sid:300000594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralarticles.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital-health.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitalrole.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn-pro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn1aprotectplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnadefenceplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnservice.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpntool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnupdatesnow.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchadvanced-bestgreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"website4all.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websiteforall.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websitetoget.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"webtip.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessgram.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessplum.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wherentlybrane.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"worldwideofficialrewardssuper.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wowlifestyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnections.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendarysystemsupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlinkplaceupdatingfree.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestplayerlink.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelink.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelinks.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafesystemsupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourstablegreatupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourstablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourtechplaceforupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourultimateperfectupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfetinora.tk"; content:"Host"; http_header; classtype:web-application-activity; sid:300000639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"signupandturnyourscreenoffsafepowernow.date"; content:"Host"; http_header; classtype:web-application-activity; sid:300000471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetc.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotplanetd.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspinb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"spotspotf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetb.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springplanetf.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitea.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsitef.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stay-notified.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"stingyscent.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thefreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thequickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thespeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeheavily-thestrongfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storelatest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenewest-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-theadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thelatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeoverly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storerecent-theoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storespeedy-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeswift-theheavilyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamadvanced-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamadvanced-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamextremely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamextremely-bestnewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamfree-bestmostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestadvancedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestcurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamintensely-bestquickfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamlatest-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamlatest-bestoverlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamquick-bestmostfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"streamrecent-bestintenselyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentslearnintogether.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleandhealth.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"subeamy.pw"; content:"Host"; http_header; classtype:web-application-activity; sid:300000510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sudoo.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"sugar-legal-about13.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superiorcare.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplace4upgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplace4upgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superplaceforupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"superpromotion.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-notify.space"; content:"Host"; http_header; classtype:web-application-activity; sid:300000518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-club.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"survey-review.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncadvanced-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synccompletely-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncgreatly-bestrenewedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncheavily-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestfreefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestrecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchighly-bestspeedyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncintensely-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"synclatest-bestuberfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncoriginal-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncprogressive-besthighlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncrenewed-bestcompletelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncstrong-bestextremelyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestlatestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestoriginalfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprecisefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestprogressivefile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestrefinedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncuber-bestsophisticatedfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"talskingest.top"; content:"Host"; http_header; classtype:web-application-activity; sid:300000546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tastefulwood.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdstraffic.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theable.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theconnectvpn.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecryptomoney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefatburner.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefitproject.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcurve.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthcycle.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthgo.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthpedia.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthystyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehealthyvibe.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehotshot.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenewjourney.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepackage.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestplayerlinks.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"theslotomania.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablealwayssafeupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thestablegreatupgrades.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"thrillqueen.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"toovolution.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"topnotchsports.tips"; content:"Host"; http_header; classtype:web-application-activity; sid:300000573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficbounce.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficgate.cc"; content:"Host"; http_header; classtype:web-application-activity; sid:300000575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trafficmind.pro"; content:"Host"; http_header; classtype:web-application-activity; sid:300000576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trane.fun"; content:"Host"; http_header; classtype:web-application-activity; sid:300000577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"trktraf.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"tryoneshot-keto.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uclaimrewards.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unequalfaucet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniremedy.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitehealth.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatcboulevard.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmstreet.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeatmway.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecurrent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thecurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-thenewestfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updategreatly-therecentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatelatest-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"updaterecent-thegreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upmakesite.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"upplayglobal.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vexearth.xyz"; content:"Host"; http_header; classtype:web-application-activity; sid:300000595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viral-surveys.win"; content:"Host"; http_header; classtype:web-application-activity; sid:300000596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralarticles.net"; content:"Host"; http_header; classtype:web-application-activity; sid:300000597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital-health.club"; content:"Host"; http_header; classtype:web-application-activity; sid:300000598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitalrole.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn-pro.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpn1aprotectplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnadefenceplus.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnservice.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpntool.me"; content:"Host"; http_header; classtype:web-application-activity; sid:300000604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpnupdatesnow.com"; content:"Host"; http_header; classtype:web-application-activity; sid:300000605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchadvanced-bestgreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchgreatly-bestcurrentfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchlatest-bestgreatlyfile.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"website4all.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websiteforall.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"websitetoget.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"webtip.co"; content:"Host"; http_header; classtype:web-application-activity; sid:300000612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessgram.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellnessplum.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wherentlybrane.site"; content:"Host"; http_header; classtype:web-application-activity; sid:300000615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"worldwideofficialrewardssuper.cyou"; content:"Host"; http_header; classtype:web-application-activity; sid:300000616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"wowlifestyle.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestlinkupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnection.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbestvideoconnections.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayer.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourbettercleanplayers.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrade.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplaceupgrading.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryplayerupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendarysystemsupgrade.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlegendaryvideoupgrading.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourlinkplaceupdatingfree.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestplayerlink.best"; content:"Host"; http_header; classtype:web-application-activity; sid:300000634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafestreliablelink.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelink.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafeststablelinks.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoursafesystemsupdating.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourstablegreatupdate.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourstablegreatupdates.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourtechplaceforupgrades.info"; content:"Host"; http_header; classtype:web-application-activity; sid:300000641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourultimateperfectupgrades.work"; content:"Host"; http_header; classtype:web-application-activity; sid:300000642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"pup-filter PUP website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfetinora.tk"; content:"Host"; http_header; classtype:web-application-activity; sid:300000643; rev:1;)

744
dist/pup-filter-snort3.rules vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains Snort3 Ruleset
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,165 +18,165 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"altcasino.info",nocase; classtype:web-application-activity; sid:300000011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"amateurxporn.com",nocase; classtype:web-application-activity; sid:300000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"amobil.online",nocase; classtype:web-application-activity; sid:300000013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"apptool.me",nocase; classtype:web-application-activity; sid:300000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ashtdi.cn",nocase; classtype:web-application-activity; sid:300000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"assuredhealth.info",nocase; classtype:web-application-activity; sid:300000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"asufij.xyz",nocase; classtype:web-application-activity; sid:300000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"auto-lawyer.site",nocase; classtype:web-application-activity; sid:300000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"baseofmp3.com",nocase; classtype:web-application-activity; sid:300000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestappland.me",nocase; classtype:web-application-activity; sid:300000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestresults.xyz",nocase; classtype:web-application-activity; sid:300000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestvideoplayerupgrades.work",nocase; classtype:web-application-activity; sid:300000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayer.info",nocase; classtype:web-application-activity; sid:300000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayers.info",nocase; classtype:web-application-activity; sid:300000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigcbd.info",nocase; classtype:web-application-activity; sid:300000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigdaycasino.info",nocase; classtype:web-application-activity; sid:300000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigwin-online-free-congrats.cyou",nocase; classtype:web-application-activity; sid:300000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigwinonlinefreecongrats.cyou",nocase; classtype:web-application-activity; sid:300000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoin-trader.me",nocase; classtype:web-application-activity; sid:300000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoinjunction.club",nocase; classtype:web-application-activity; sid:300000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bittrend.com",nocase; classtype:web-application-activity; sid:300000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"biztherapy.info",nocase; classtype:web-application-activity; sid:300000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"blockchain-com.email",nocase; classtype:web-application-activity; sid:300000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyamaze.club",nocase; classtype:web-application-activity; sid:300000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyselfcare.info",nocase; classtype:web-application-activity; sid:300000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upcompletely-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upcompletely-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upfree-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upoverly-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-uprefined-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upuber-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"browsercheck.site",nocase; classtype:web-application-activity; sid:300000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"btcinvesting.info",nocase; classtype:web-application-activity; sid:300000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bulley.shop",nocase; classtype:web-application-activity; sid:300000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cabins-r-us.com",nocase; classtype:web-application-activity; sid:300000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"calculateprint.xyz",nocase; classtype:web-application-activity; sid:300000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"care-connection.info",nocase; classtype:web-application-activity; sid:300000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carebility.info",nocase; classtype:web-application-activity; sid:300000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"careerconnecthub.com",nocase; classtype:web-application-activity; sid:300000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carevision.info",nocase; classtype:web-application-activity; sid:300000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"celebseven.com",nocase; classtype:web-application-activity; sid:300000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"centrodeartigos.com",nocase; classtype:web-application-activity; sid:300000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"check-your-profitzone.life",nocase; classtype:web-application-activity; sid:300000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cheerplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.casa",nocase; classtype:web-application-activity; sid:300000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.cyou",nocase; classtype:web-application-activity; sid:300000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.fun",nocase; classtype:web-application-activity; sid:300000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.surf",nocase; classtype:web-application-activity; sid:300000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"coachbelief.xyz",nocase; classtype:web-application-activity; sid:300000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"collectrewards.net",nocase; classtype:web-application-activity; sid:300000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"comphp.xyz",nocase; classtype:web-application-activity; sid:300000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conceivecolor.xyz",nocase; classtype:web-application-activity; sid:300000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conflaqpzc.info",nocase; classtype:web-application-activity; sid:300000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"congrats-lucky-giveaway-smart.cyou",nocase; classtype:web-application-activity; sid:300000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"congratsluckygiveawaysmart.cyou",nocase; classtype:web-application-activity; sid:300000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"connectionapplication.com",nocase; classtype:web-application-activity; sid:300000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.cam",nocase; classtype:web-application-activity; sid:300000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.club",nocase; classtype:web-application-activity; sid:300000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.fun",nocase; classtype:web-application-activity; sid:300000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.uno",nocase; classtype:web-application-activity; sid:300000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cooing.top",nocase; classtype:web-application-activity; sid:300000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-alerts.xyz",nocase; classtype:web-application-activity; sid:300000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-monitor.xyz",nocase; classtype:web-application-activity; sid:300000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-resources.xyz",nocase; classtype:web-application-activity; sid:300000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotilt.club",nocase; classtype:web-application-activity; sid:300000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotradingcourses.net",nocase; classtype:web-application-activity; sid:300000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptounlimited.info",nocase; classtype:web-application-activity; sid:300000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cs-alerts.xyz",nocase; classtype:web-application-activity; sid:300000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cselfconnect.com",nocase; classtype:web-application-activity; sid:300000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"curesector.today",nocase; classtype:web-application-activity; sid:300000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.casa",nocase; classtype:web-application-activity; sid:300000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.cyou",nocase; classtype:web-application-activity; sid:300000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.monster",nocase; classtype:web-application-activity; sid:300000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.site",nocase; classtype:web-application-activity; sid:300000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.space",nocase; classtype:web-application-activity; sid:300000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.surf",nocase; classtype:web-application-activity; sid:300000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.work",nocase; classtype:web-application-activity; sid:300000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailyrep.net",nocase; classtype:web-application-activity; sid:300000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"degreenm.top",nocase; classtype:web-application-activity; sid:300000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"delightcmain.xyz",nocase; classtype:web-application-activity; sid:300000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"digitalinvest.news",nocase; classtype:web-application-activity; sid:300000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"displayfriend.xyz",nocase; classtype:web-application-activity; sid:300000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ditvl.com",nocase; classtype:web-application-activity; sid:300000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dragonballclub.com",nocase; classtype:web-application-activity; sid:300000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eanswers.net",nocase; classtype:web-application-activity; sid:300000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ehousan.top",nocase; classtype:web-application-activity; sid:300000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eproute.info",nocase; classtype:web-application-activity; sid:300000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eroanimeittyokusen.com",nocase; classtype:web-application-activity; sid:300000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"erotica.live",nocase; classtype:web-application-activity; sid:300000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"excitingthing.xyz",nocase; classtype:web-application-activity; sid:300000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"extrasafe.xyz",nocase; classtype:web-application-activity; sid:300000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"facebook-sex.com",nocase; classtype:web-application-activity; sid:300000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapc.xyz",nocase; classtype:web-application-activity; sid:300000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapf.xyz",nocase; classtype:web-application-activity; sid:300000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastplanetf.xyz",nocase; classtype:web-application-activity; sid:300000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspota.xyz",nocase; classtype:web-application-activity; sid:300000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspotb.xyz",nocase; classtype:web-application-activity; sid:300000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastwebe.xyz",nocase; classtype:web-application-activity; sid:300000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmesonlineturbo.net",nocase; classtype:web-application-activity; sid:300000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmrod.xyz",nocase; classtype:web-application-activity; sid:300000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"films-down.com",nocase; classtype:web-application-activity; sid:300000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"financial-deals.xyz",nocase; classtype:web-application-activity; sid:300000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findforus.net",nocase; classtype:web-application-activity; sid:300000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findoffers.co",nocase; classtype:web-application-activity; sid:300000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces2download.work",nocase; classtype:web-application-activity; sid:300000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces4download.work",nocase; classtype:web-application-activity; sid:300000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findyourultimateplayersfirst.best",nocase; classtype:web-application-activity; sid:300000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"firststableplayer.work",nocase; classtype:web-application-activity; sid:300000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fisham.site",nocase; classtype:web-application-activity; sid:300000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandready.info",nocase; classtype:web-application-activity; sid:300000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandstable.club",nocase; classtype:web-application-activity; sid:300000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitbodyandsoul.info",nocase; classtype:web-application-activity; sid:300000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitcourage.info",nocase; classtype:web-application-activity; sid:300000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspark.info",nocase; classtype:web-application-activity; sid:300000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspot.club",nocase; classtype:web-application-activity; sid:300000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthsure.info",nocase; classtype:web-application-activity; sid:300000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitlifevalue.info",nocase; classtype:web-application-activity; sid:300000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitnessdial.club",nocase; classtype:web-application-activity; sid:300000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitsure.info",nocase; classtype:web-application-activity; sid:300000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flash-rewards.info",nocase; classtype:web-application-activity; sid:300000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flatbellylife.info",nocase; classtype:web-application-activity; sid:300000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flexroll.online",nocase; classtype:web-application-activity; sid:300000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flyfreecostas.live",nocase; classtype:web-application-activity; sid:300000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"foregoingpump.xyz",nocase; classtype:web-application-activity; sid:300000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"forsalecheap.net",nocase; classtype:web-application-activity; sid:300000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"free-gifts.net",nocase; classtype:web-application-activity; sid:300000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrade.work",nocase; classtype:web-application-activity; sid:300000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrading.work",nocase; classtype:web-application-activity; sid:300000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freshclover.info",nocase; classtype:web-application-activity; sid:300000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fuck-me-hard.club",nocase; classtype:web-application-activity; sid:300000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapc.xyz",nocase; classtype:web-application-activity; sid:300000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapd.xyz",nocase; classtype:web-application-activity; sid:300000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funplanetb.xyz",nocase; classtype:web-application-activity; sid:300000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funsiteb.xyz",nocase; classtype:web-application-activity; sid:300000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspinf.xyz",nocase; classtype:web-application-activity; sid:300000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspotf.xyz",nocase; classtype:web-application-activity; sid:300000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funwebd.xyz",nocase; classtype:web-application-activity; sid:300000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fwsxqc.cn",nocase; classtype:web-application-activity; sid:300000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gainhealth.info",nocase; classtype:web-application-activity; sid:300000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gapingshame.xyz",nocase; classtype:web-application-activity; sid:300000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"generouscare.info",nocase; classtype:web-application-activity; sid:300000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getmoregirls.net",nocase; classtype:web-application-activity; sid:300000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getstablesystemupgrades.work",nocase; classtype:web-application-activity; sid:300000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladdboulevard.xyz",nocase; classtype:web-application-activity; sid:300000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladmstreet.xyz",nocase; classtype:web-application-activity; sid:300000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladslotweb.xyz",nocase; classtype:web-application-activity; sid:300000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspaceplane.xyz",nocase; classtype:web-application-activity; sid:300000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotplay.xyz",nocase; classtype:web-application-activity; sid:300000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotwonder.xyz",nocase; classtype:web-application-activity; sid:300000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.fun",nocase; classtype:web-application-activity; sid:300000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.online",nocase; classtype:web-application-activity; sid:300000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.site",nocase; classtype:web-application-activity; sid:300000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.surf",nocase; classtype:web-application-activity; sid:300000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.website",nocase; classtype:web-application-activity; sid:300000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"global-info.space",nocase; classtype:web-application-activity; sid:300000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"animenation.org",nocase; classtype:web-application-activity; sid:300000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"apptool.me",nocase; classtype:web-application-activity; sid:300000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ashtdi.cn",nocase; classtype:web-application-activity; sid:300000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"assuredhealth.info",nocase; classtype:web-application-activity; sid:300000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"asufij.xyz",nocase; classtype:web-application-activity; sid:300000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"auto-lawyer.site",nocase; classtype:web-application-activity; sid:300000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"baseofmp3.com",nocase; classtype:web-application-activity; sid:300000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestappland.me",nocase; classtype:web-application-activity; sid:300000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestresults.xyz",nocase; classtype:web-application-activity; sid:300000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bestvideoplayerupgrades.work",nocase; classtype:web-application-activity; sid:300000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayer.info",nocase; classtype:web-application-activity; sid:300000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"betterfreedownloadplayers.info",nocase; classtype:web-application-activity; sid:300000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigcbd.info",nocase; classtype:web-application-activity; sid:300000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigdaycasino.info",nocase; classtype:web-application-activity; sid:300000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigwin-online-free-congrats.cyou",nocase; classtype:web-application-activity; sid:300000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bigwinonlinefreecongrats.cyou",nocase; classtype:web-application-activity; sid:300000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoin-trader.me",nocase; classtype:web-application-activity; sid:300000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bitcoinjunction.club",nocase; classtype:web-application-activity; sid:300000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bittrend.com",nocase; classtype:web-application-activity; sid:300000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"biztherapy.info",nocase; classtype:web-application-activity; sid:300000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"blockchain-com.email",nocase; classtype:web-application-activity; sid:300000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyamaze.club",nocase; classtype:web-application-activity; sid:300000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bodyselfcare.info",nocase; classtype:web-application-activity; sid:300000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upcompletely-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upcompletely-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upfree-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upoverly-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-uprefined-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"boot-upuber-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"browsercheck.site",nocase; classtype:web-application-activity; sid:300000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"btcinvesting.info",nocase; classtype:web-application-activity; sid:300000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"bulley.shop",nocase; classtype:web-application-activity; sid:300000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cabins-r-us.com",nocase; classtype:web-application-activity; sid:300000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"calculateprint.xyz",nocase; classtype:web-application-activity; sid:300000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"care-connection.info",nocase; classtype:web-application-activity; sid:300000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carebility.info",nocase; classtype:web-application-activity; sid:300000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"careerconnecthub.com",nocase; classtype:web-application-activity; sid:300000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"carevision.info",nocase; classtype:web-application-activity; sid:300000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"celebseven.com",nocase; classtype:web-application-activity; sid:300000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"centrodeartigos.com",nocase; classtype:web-application-activity; sid:300000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"check-your-profitzone.life",nocase; classtype:web-application-activity; sid:300000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cheerplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.casa",nocase; classtype:web-application-activity; sid:300000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.cyou",nocase; classtype:web-application-activity; sid:300000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.fun",nocase; classtype:web-application-activity; sid:300000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cloudmedia.surf",nocase; classtype:web-application-activity; sid:300000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"coachbelief.xyz",nocase; classtype:web-application-activity; sid:300000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"collectrewards.net",nocase; classtype:web-application-activity; sid:300000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"comphp.xyz",nocase; classtype:web-application-activity; sid:300000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conceivecolor.xyz",nocase; classtype:web-application-activity; sid:300000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"conflaqpzc.info",nocase; classtype:web-application-activity; sid:300000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"congrats-lucky-giveaway-smart.cyou",nocase; classtype:web-application-activity; sid:300000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"congratsluckygiveawaysmart.cyou",nocase; classtype:web-application-activity; sid:300000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"connectionapplication.com",nocase; classtype:web-application-activity; sid:300000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.cam",nocase; classtype:web-application-activity; sid:300000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.club",nocase; classtype:web-application-activity; sid:300000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.fun",nocase; classtype:web-application-activity; sid:300000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"contentgate.uno",nocase; classtype:web-application-activity; sid:300000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cooing.top",nocase; classtype:web-application-activity; sid:300000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-alerts.xyz",nocase; classtype:web-application-activity; sid:300000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-monitor.xyz",nocase; classtype:web-application-activity; sid:300000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"credit-resources.xyz",nocase; classtype:web-application-activity; sid:300000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotilt.club",nocase; classtype:web-application-activity; sid:300000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptotradingcourses.net",nocase; classtype:web-application-activity; sid:300000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cryptounlimited.info",nocase; classtype:web-application-activity; sid:300000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cs-alerts.xyz",nocase; classtype:web-application-activity; sid:300000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"cselfconnect.com",nocase; classtype:web-application-activity; sid:300000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"curesector.today",nocase; classtype:web-application-activity; sid:300000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.casa",nocase; classtype:web-application-activity; sid:300000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.cyou",nocase; classtype:web-application-activity; sid:300000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.monster",nocase; classtype:web-application-activity; sid:300000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.site",nocase; classtype:web-application-activity; sid:300000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.space",nocase; classtype:web-application-activity; sid:300000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.surf",nocase; classtype:web-application-activity; sid:300000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailymedia.work",nocase; classtype:web-application-activity; sid:300000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dailyrep.net",nocase; classtype:web-application-activity; sid:300000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"degreenm.top",nocase; classtype:web-application-activity; sid:300000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"delightcmain.xyz",nocase; classtype:web-application-activity; sid:300000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"digitalinvest.news",nocase; classtype:web-application-activity; sid:300000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"displayfriend.xyz",nocase; classtype:web-application-activity; sid:300000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ditvl.com",nocase; classtype:web-application-activity; sid:300000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"dragonballclub.com",nocase; classtype:web-application-activity; sid:300000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eanswers.net",nocase; classtype:web-application-activity; sid:300000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ehousan.top",nocase; classtype:web-application-activity; sid:300000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eproute.info",nocase; classtype:web-application-activity; sid:300000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"eroanimeittyokusen.com",nocase; classtype:web-application-activity; sid:300000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"erotica.live",nocase; classtype:web-application-activity; sid:300000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"excitingthing.xyz",nocase; classtype:web-application-activity; sid:300000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"extrasafe.xyz",nocase; classtype:web-application-activity; sid:300000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"facebook-sex.com",nocase; classtype:web-application-activity; sid:300000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapc.xyz",nocase; classtype:web-application-activity; sid:300000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastmapf.xyz",nocase; classtype:web-application-activity; sid:300000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastplanetf.xyz",nocase; classtype:web-application-activity; sid:300000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspota.xyz",nocase; classtype:web-application-activity; sid:300000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastspotb.xyz",nocase; classtype:web-application-activity; sid:300000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fastwebe.xyz",nocase; classtype:web-application-activity; sid:300000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmesonlineturbo.net",nocase; classtype:web-application-activity; sid:300000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"filmrod.xyz",nocase; classtype:web-application-activity; sid:300000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"films-down.com",nocase; classtype:web-application-activity; sid:300000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"financial-deals.xyz",nocase; classtype:web-application-activity; sid:300000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findforus.net",nocase; classtype:web-application-activity; sid:300000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findoffers.co",nocase; classtype:web-application-activity; sid:300000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces2download.work",nocase; classtype:web-application-activity; sid:300000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findperfectplaces4download.work",nocase; classtype:web-application-activity; sid:300000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"findyourultimateplayersfirst.best",nocase; classtype:web-application-activity; sid:300000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"firststableplayer.work",nocase; classtype:web-application-activity; sid:300000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fisham.site",nocase; classtype:web-application-activity; sid:300000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandready.info",nocase; classtype:web-application-activity; sid:300000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitandstable.club",nocase; classtype:web-application-activity; sid:300000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitbodyandsoul.info",nocase; classtype:web-application-activity; sid:300000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitcourage.info",nocase; classtype:web-application-activity; sid:300000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspark.info",nocase; classtype:web-application-activity; sid:300000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthspot.club",nocase; classtype:web-application-activity; sid:300000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fithealthsure.info",nocase; classtype:web-application-activity; sid:300000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitlifevalue.info",nocase; classtype:web-application-activity; sid:300000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitnessdial.club",nocase; classtype:web-application-activity; sid:300000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fitsure.info",nocase; classtype:web-application-activity; sid:300000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flash-rewards.info",nocase; classtype:web-application-activity; sid:300000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flatbellylife.info",nocase; classtype:web-application-activity; sid:300000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flexroll.online",nocase; classtype:web-application-activity; sid:300000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"flyfreecostas.live",nocase; classtype:web-application-activity; sid:300000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"foregoingpump.xyz",nocase; classtype:web-application-activity; sid:300000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"forsalecheap.net",nocase; classtype:web-application-activity; sid:300000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"free-gifts.net",nocase; classtype:web-application-activity; sid:300000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrade.work",nocase; classtype:web-application-activity; sid:300000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freeperfectupgrading.work",nocase; classtype:web-application-activity; sid:300000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"freshclover.info",nocase; classtype:web-application-activity; sid:300000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fuck-me-hard.club",nocase; classtype:web-application-activity; sid:300000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapc.xyz",nocase; classtype:web-application-activity; sid:300000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funmapd.xyz",nocase; classtype:web-application-activity; sid:300000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funplanetb.xyz",nocase; classtype:web-application-activity; sid:300000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funsiteb.xyz",nocase; classtype:web-application-activity; sid:300000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspinf.xyz",nocase; classtype:web-application-activity; sid:300000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funspotf.xyz",nocase; classtype:web-application-activity; sid:300000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"funwebd.xyz",nocase; classtype:web-application-activity; sid:300000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"fwsxqc.cn",nocase; classtype:web-application-activity; sid:300000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gainhealth.info",nocase; classtype:web-application-activity; sid:300000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gapingshame.xyz",nocase; classtype:web-application-activity; sid:300000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"generouscare.info",nocase; classtype:web-application-activity; sid:300000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getmoregirls.net",nocase; classtype:web-application-activity; sid:300000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"getstablesystemupgrades.work",nocase; classtype:web-application-activity; sid:300000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladdboulevard.xyz",nocase; classtype:web-application-activity; sid:300000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladmstreet.xyz",nocase; classtype:web-application-activity; sid:300000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladplaceweb.xyz",nocase; classtype:web-application-activity; sid:300000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladslotweb.xyz",nocase; classtype:web-application-activity; sid:300000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspaceplane.xyz",nocase; classtype:web-application-activity; sid:300000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotplay.xyz",nocase; classtype:web-application-activity; sid:300000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladspotwonder.xyz",nocase; classtype:web-application-activity; sid:300000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.fun",nocase; classtype:web-application-activity; sid:300000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.online",nocase; classtype:web-application-activity; sid:300000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.site",nocase; classtype:web-application-activity; sid:300000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.surf",nocase; classtype:web-application-activity; sid:300000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"gladvideo.website",nocase; classtype:web-application-activity; sid:300000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.fun",nocase; classtype:web-application-activity; sid:300000173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"globalvideo.store",nocase; classtype:web-application-activity; sid:300000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"go-x34n7wbcoes-ok.live",nocase; classtype:web-application-activity; sid:300000175; rev:1;)
@ -226,42 +226,42 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"healthysure.info",nocase; classtype:web-application-activity; sid:300000219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"httqzq.vip",nocase; classtype:web-application-activity; sid:300000220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"idtheft-alert.xyz",nocase; classtype:web-application-activity; sid:300000221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iketo.diet",nocase; classtype:web-application-activity; sid:300000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"inappropriate.top",nocase; classtype:web-application-activity; sid:300000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"information.casa",nocase; classtype:web-application-activity; sid:300000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"instablog.club",nocase; classtype:web-application-activity; sid:300000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"installcompletely-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"insuredhealth.info",nocase; classtype:web-application-activity; sid:300000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosdfnc.com",nocase; classtype:web-application-activity; sid:300000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosrecommendedvpn.com",nocase; classtype:web-application-activity; sid:300000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosvpnsecure.com",nocase; classtype:web-application-activity; sid:300000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"izipik.com",nocase; classtype:web-application-activity; sid:300000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"java-forum.org",nocase; classtype:web-application-activity; sid:300000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyplaceplay.xyz",nocase; classtype:web-application-activity; sid:300000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotmap.xyz",nocase; classtype:web-application-activity; sid:300000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotspin.xyz",nocase; classtype:web-application-activity; sid:300000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jsrenthouse.com",nocase; classtype:web-application-activity; sid:300000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jubilantdstreet.xyz",nocase; classtype:web-application-activity; sid:300000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"kad3md.cn",nocase; classtype:web-application-activity; sid:300000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"keepithealthy.info",nocase; classtype:web-application-activity; sid:300000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ketodietrecipes.org",nocase; classtype:web-application-activity; sid:300000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"leeching.net",nocase; classtype:web-application-activity; sid:300000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrading.info",nocase; classtype:web-application-activity; sid:300000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplayerupdates.work",nocase; classtype:web-application-activity; sid:300000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendarysiteupgrading.work",nocase; classtype:web-application-activity; sid:300000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrade.info",nocase; classtype:web-application-activity; sid:300000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"life-esteem.info",nocase; classtype:web-application-activity; sid:300000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lifecaregoal.info",nocase; classtype:web-application-activity; sid:300000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lightstop.xyz",nocase; classtype:web-application-activity; sid:300000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livehealthcare.today",nocase; classtype:web-application-activity; sid:300000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livelyyroad.xyz",nocase; classtype:web-application-activity; sid:300000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livingmighty.club",nocase; classtype:web-application-activity; sid:300000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loaddevelopeduberfile.digital",nocase; classtype:web-application-activity; sid:300000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadfree-bestheavilyfile.best",nocase; classtype:web-application-activity; sid:300000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"inappropriate.top",nocase; classtype:web-application-activity; sid:300000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"information.casa",nocase; classtype:web-application-activity; sid:300000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"instablog.club",nocase; classtype:web-application-activity; sid:300000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"installcompletely-theoriginalfile.best",nocase; classtype:web-application-activity; sid:300000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"insuredhealth.info",nocase; classtype:web-application-activity; sid:300000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosdfnc.com",nocase; classtype:web-application-activity; sid:300000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosrecommendedvpn.com",nocase; classtype:web-application-activity; sid:300000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"iosvpnsecure.com",nocase; classtype:web-application-activity; sid:300000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"izipik.com",nocase; classtype:web-application-activity; sid:300000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"java-forum.org",nocase; classtype:web-application-activity; sid:300000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyplaceplay.xyz",nocase; classtype:web-application-activity; sid:300000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotmap.xyz",nocase; classtype:web-application-activity; sid:300000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"joyspotspin.xyz",nocase; classtype:web-application-activity; sid:300000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jsrenthouse.com",nocase; classtype:web-application-activity; sid:300000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"jubilantdstreet.xyz",nocase; classtype:web-application-activity; sid:300000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"kad3md.cn",nocase; classtype:web-application-activity; sid:300000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"keepithealthy.info",nocase; classtype:web-application-activity; sid:300000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ketodietrecipes.org",nocase; classtype:web-application-activity; sid:300000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"leeching.net",nocase; classtype:web-application-activity; sid:300000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplaceupgrading.info",nocase; classtype:web-application-activity; sid:300000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryplayerupdates.work",nocase; classtype:web-application-activity; sid:300000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendarysiteupgrading.work",nocase; classtype:web-application-activity; sid:300000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrade.info",nocase; classtype:web-application-activity; sid:300000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"legendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"life-esteem.info",nocase; classtype:web-application-activity; sid:300000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lifecaregoal.info",nocase; classtype:web-application-activity; sid:300000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"lightstop.xyz",nocase; classtype:web-application-activity; sid:300000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livehealthcare.today",nocase; classtype:web-application-activity; sid:300000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livelyyroad.xyz",nocase; classtype:web-application-activity; sid:300000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"livingmighty.club",nocase; classtype:web-application-activity; sid:300000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loaddevelopeduberfile.digital",nocase; classtype:web-application-activity; sid:300000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadfree-bestheavilyfile.best",nocase; classtype:web-application-activity; sid:300000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadfreeextremelyfile.digital",nocase; classtype:web-application-activity; sid:300000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"loadgreatly-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000260; rev:1;)
@ -402,12 +402,12 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primawise.info",nocase; classtype:web-application-activity; sid:300000395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"primecare.today",nocase; classtype:web-application-activity; sid:300000396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"privacykeeper.net",nocase; classtype:web-application-activity; sid:300000397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"productiq.net",nocase; classtype:web-application-activity; sid:300000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"prohealthroutine.info",nocase; classtype:web-application-activity; sid:300000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protect-connection.com",nocase; classtype:web-application-activity; sid:300000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"prohealthroutine.info",nocase; classtype:web-application-activity; sid:300000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protect-connection.com",nocase; classtype:web-application-activity; sid:300000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protecttool.me",nocase; classtype:web-application-activity; sid:300000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"protectyourvpn.com",nocase; classtype:web-application-activity; sid:300000401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"quantum.work",nocase; classtype:web-application-activity; sid:300000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"quickdeals.online",nocase; classtype:web-application-activity; sid:300000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"provpnservice.me",nocase; classtype:web-application-activity; sid:300000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"quantum.work",nocase; classtype:web-application-activity; sid:300000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"rainlonginsect23.life",nocase; classtype:web-application-activity; sid:300000404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"random-prize-bigwin-official.cyou",nocase; classtype:web-application-activity; sid:300000405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"randomprizebigwinofficial.cyou",nocase; classtype:web-application-activity; sid:300000406; rev:1;)
@ -475,172 +475,176 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shkshk.site",nocase; classtype:web-application-activity; sid:300000468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shopnsave.world",nocase; classtype:web-application-activity; sid:300000469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"shoppingexp.xyz",nocase; classtype:web-application-activity; sid:300000470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetc.xyz",nocase; classtype:web-application-activity; sid:300000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetd.xyz",nocase; classtype:web-application-activity; sid:300000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspinb.xyz",nocase; classtype:web-application-activity; sid:300000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspotf.xyz",nocase; classtype:web-application-activity; sid:300000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetb.xyz",nocase; classtype:web-application-activity; sid:300000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetf.xyz",nocase; classtype:web-application-activity; sid:300000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitea.xyz",nocase; classtype:web-application-activity; sid:300000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitef.xyz",nocase; classtype:web-application-activity; sid:300000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stay-notified.cc",nocase; classtype:web-application-activity; sid:300000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stingyscent.xyz",nocase; classtype:web-application-activity; sid:300000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thefreefile.best",nocase; classtype:web-application-activity; sid:300000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thequickfile.best",nocase; classtype:web-application-activity; sid:300000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storelatest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storenewest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-theadvancedfile.best",nocase; classtype:web-application-activity; sid:300000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storerecent-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storespeedy-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeswift-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamadvanced-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamadvanced-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamextremely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamextremely-bestnewestfile.best",nocase; classtype:web-application-activity; sid:300000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamfree-bestmostfile.best",nocase; classtype:web-application-activity; sid:300000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestcurrentfile.best",nocase; classtype:web-application-activity; sid:300000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamlatest-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamlatest-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamquick-bestmostfile.best",nocase; classtype:web-application-activity; sid:300000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamrecent-bestintenselyfile.best",nocase; classtype:web-application-activity; sid:300000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"styleandhealth.info",nocase; classtype:web-application-activity; sid:300000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"subeamy.pw",nocase; classtype:web-application-activity; sid:300000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sudoo.net",nocase; classtype:web-application-activity; sid:300000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sugar-legal-about13.fun",nocase; classtype:web-application-activity; sid:300000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superiorcare.info",nocase; classtype:web-application-activity; sid:300000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplace4upgrade.work",nocase; classtype:web-application-activity; sid:300000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplace4upgrading.work",nocase; classtype:web-application-activity; sid:300000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplaceforupgrade.info",nocase; classtype:web-application-activity; sid:300000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superpromotion.cyou",nocase; classtype:web-application-activity; sid:300000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"support-notify.space",nocase; classtype:web-application-activity; sid:300000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-club.club",nocase; classtype:web-application-activity; sid:300000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-review.club",nocase; classtype:web-application-activity; sid:300000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncadvanced-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncgreatly-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncheavily-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncintensely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synclatest-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncoriginal-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncrenewed-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncstrong-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestrefinedfile.best",nocase; classtype:web-application-activity; sid:300000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"talskingest.top",nocase; classtype:web-application-activity; sid:300000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tastefulwood.xyz",nocase; classtype:web-application-activity; sid:300000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tdstraffic.xyz",nocase; classtype:web-application-activity; sid:300000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theable.me",nocase; classtype:web-application-activity; sid:300000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theconnectvpn.com",nocase; classtype:web-application-activity; sid:300000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thecryptomoney.info",nocase; classtype:web-application-activity; sid:300000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefatburner.info",nocase; classtype:web-application-activity; sid:300000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefitproject.club",nocase; classtype:web-application-activity; sid:300000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcurve.info",nocase; classtype:web-application-activity; sid:300000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcycle.club",nocase; classtype:web-application-activity; sid:300000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthgo.info",nocase; classtype:web-application-activity; sid:300000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthpedia.info",nocase; classtype:web-application-activity; sid:300000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthystyle.info",nocase; classtype:web-application-activity; sid:300000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthyvibe.info",nocase; classtype:web-application-activity; sid:300000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehotshot.info",nocase; classtype:web-application-activity; sid:300000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thelastpicture.show",nocase; classtype:web-application-activity; sid:300000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thenewjourney.info",nocase; classtype:web-application-activity; sid:300000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thepackage.club",nocase; classtype:web-application-activity; sid:300000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestplayerlinks.work",nocase; classtype:web-application-activity; sid:300000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theslotomania.info",nocase; classtype:web-application-activity; sid:300000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablealwayssafeupdates.work",nocase; classtype:web-application-activity; sid:300000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupgrades.best",nocase; classtype:web-application-activity; sid:300000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thrillqueen.xyz",nocase; classtype:web-application-activity; sid:300000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"toovolution.club",nocase; classtype:web-application-activity; sid:300000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"topnotchsports.tips",nocase; classtype:web-application-activity; sid:300000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficbounce.net",nocase; classtype:web-application-activity; sid:300000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficgate.cc",nocase; classtype:web-application-activity; sid:300000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trane.fun",nocase; classtype:web-application-activity; sid:300000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trktraf.club",nocase; classtype:web-application-activity; sid:300000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tryoneshot-keto.net",nocase; classtype:web-application-activity; sid:300000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uclaimrewards.net",nocase; classtype:web-application-activity; sid:300000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unequalfaucet.xyz",nocase; classtype:web-application-activity; sid:300000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uniremedy.info",nocase; classtype:web-application-activity; sid:300000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unitehealth.club",nocase; classtype:web-application-activity; sid:300000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmstreet.xyz",nocase; classtype:web-application-activity; sid:300000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmway.xyz",nocase; classtype:web-application-activity; sid:300000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatecurrent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatelatest-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updaterecent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upmakesite.xyz",nocase; classtype:web-application-activity; sid:300000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vexearth.xyz",nocase; classtype:web-application-activity; sid:300000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viral-surveys.win",nocase; classtype:web-application-activity; sid:300000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viralarticles.net",nocase; classtype:web-application-activity; sid:300000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vital-health.club",nocase; classtype:web-application-activity; sid:300000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vitalrole.info",nocase; classtype:web-application-activity; sid:300000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn-pro.info",nocase; classtype:web-application-activity; sid:300000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn1aprotectplus.com",nocase; classtype:web-application-activity; sid:300000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnadefenceplus.com",nocase; classtype:web-application-activity; sid:300000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnservice.me",nocase; classtype:web-application-activity; sid:300000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpntool.me",nocase; classtype:web-application-activity; sid:300000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnupdatesnow.com",nocase; classtype:web-application-activity; sid:300000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"watchadvanced-bestgreatlyfile.best",nocase; classtype:web-application-activity; sid:300000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"website4all.info",nocase; classtype:web-application-activity; sid:300000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websiteforall.work",nocase; classtype:web-application-activity; sid:300000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websitetoget.work",nocase; classtype:web-application-activity; sid:300000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"webtip.co",nocase; classtype:web-application-activity; sid:300000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessgram.info",nocase; classtype:web-application-activity; sid:300000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessplum.info",nocase; classtype:web-application-activity; sid:300000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wherentlybrane.site",nocase; classtype:web-application-activity; sid:300000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"worldwideofficialrewardssuper.cyou",nocase; classtype:web-application-activity; sid:300000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wowlifestyle.info",nocase; classtype:web-application-activity; sid:300000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnection.info",nocase; classtype:web-application-activity; sid:300000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnections.info",nocase; classtype:web-application-activity; sid:300000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrading.work",nocase; classtype:web-application-activity; sid:300000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdate.work",nocase; classtype:web-application-activity; sid:300000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdating.work",nocase; classtype:web-application-activity; sid:300000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendarysystemsupgrade.work",nocase; classtype:web-application-activity; sid:300000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlinkplaceupdatingfree.work",nocase; classtype:web-application-activity; sid:300000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestplayerlink.best",nocase; classtype:web-application-activity; sid:300000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelink.info",nocase; classtype:web-application-activity; sid:300000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelinks.info",nocase; classtype:web-application-activity; sid:300000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafesystemsupdating.work",nocase; classtype:web-application-activity; sid:300000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourstablegreatupdate.work",nocase; classtype:web-application-activity; sid:300000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourstablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourtechplaceforupgrades.info",nocase; classtype:web-application-activity; sid:300000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourultimateperfectupgrades.work",nocase; classtype:web-application-activity; sid:300000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ysfetinora.tk",nocase; classtype:web-application-activity; sid:300000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"signupandturnyourscreenoffsafepowernow.date",nocase; classtype:web-application-activity; sid:300000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetc.xyz",nocase; classtype:web-application-activity; sid:300000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotplanetd.xyz",nocase; classtype:web-application-activity; sid:300000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspinb.xyz",nocase; classtype:web-application-activity; sid:300000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"spotspotf.xyz",nocase; classtype:web-application-activity; sid:300000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetb.xyz",nocase; classtype:web-application-activity; sid:300000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springplanetf.xyz",nocase; classtype:web-application-activity; sid:300000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitea.xyz",nocase; classtype:web-application-activity; sid:300000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"springsitef.xyz",nocase; classtype:web-application-activity; sid:300000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stay-notified.cc",nocase; classtype:web-application-activity; sid:300000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"stingyscent.xyz",nocase; classtype:web-application-activity; sid:300000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thefreefile.best",nocase; classtype:web-application-activity; sid:300000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thequickfile.best",nocase; classtype:web-application-activity; sid:300000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thespeedyfile.best",nocase; classtype:web-application-activity; sid:300000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeheavily-thestrongfile.best",nocase; classtype:web-application-activity; sid:300000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storelatest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storenewest-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-theadvancedfile.best",nocase; classtype:web-application-activity; sid:300000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thelatestfile.best",nocase; classtype:web-application-activity; sid:300000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeoverly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storerecent-theoverlyfile.best",nocase; classtype:web-application-activity; sid:300000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storespeedy-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"storeswift-theheavilyfile.best",nocase; classtype:web-application-activity; sid:300000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamadvanced-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamadvanced-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamextremely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamextremely-bestnewestfile.best",nocase; classtype:web-application-activity; sid:300000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamfree-bestmostfile.best",nocase; classtype:web-application-activity; sid:300000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestadvancedfile.best",nocase; classtype:web-application-activity; sid:300000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestcurrentfile.best",nocase; classtype:web-application-activity; sid:300000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamintensely-bestquickfile.best",nocase; classtype:web-application-activity; sid:300000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamlatest-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamlatest-bestoverlyfile.best",nocase; classtype:web-application-activity; sid:300000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamquick-bestmostfile.best",nocase; classtype:web-application-activity; sid:300000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"streamrecent-bestintenselyfile.best",nocase; classtype:web-application-activity; sid:300000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"studentslearnintogether.club",nocase; classtype:web-application-activity; sid:300000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"styleandhealth.info",nocase; classtype:web-application-activity; sid:300000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"subeamy.pw",nocase; classtype:web-application-activity; sid:300000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sudoo.net",nocase; classtype:web-application-activity; sid:300000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"sugar-legal-about13.fun",nocase; classtype:web-application-activity; sid:300000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superiorcare.info",nocase; classtype:web-application-activity; sid:300000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplace4upgrade.work",nocase; classtype:web-application-activity; sid:300000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplace4upgrading.work",nocase; classtype:web-application-activity; sid:300000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superplaceforupgrade.info",nocase; classtype:web-application-activity; sid:300000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"superpromotion.cyou",nocase; classtype:web-application-activity; sid:300000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"support-notify.space",nocase; classtype:web-application-activity; sid:300000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-club.club",nocase; classtype:web-application-activity; sid:300000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"survey-review.club",nocase; classtype:web-application-activity; sid:300000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncadvanced-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synccompletely-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncgreatly-bestrenewedfile.best",nocase; classtype:web-application-activity; sid:300000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncheavily-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestfreefile.best",nocase; classtype:web-application-activity; sid:300000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestrecentfile.best",nocase; classtype:web-application-activity; sid:300000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synchighly-bestspeedyfile.best",nocase; classtype:web-application-activity; sid:300000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncintensely-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"synclatest-bestuberfile.best",nocase; classtype:web-application-activity; sid:300000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncoriginal-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncprogressive-besthighlyfile.best",nocase; classtype:web-application-activity; sid:300000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncrenewed-bestcompletelyfile.best",nocase; classtype:web-application-activity; sid:300000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncstrong-bestextremelyfile.best",nocase; classtype:web-application-activity; sid:300000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestlatestfile.best",nocase; classtype:web-application-activity; sid:300000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestoriginalfile.best",nocase; classtype:web-application-activity; sid:300000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprecisefile.best",nocase; classtype:web-application-activity; sid:300000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestprogressivefile.best",nocase; classtype:web-application-activity; sid:300000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestrefinedfile.best",nocase; classtype:web-application-activity; sid:300000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"syncuber-bestsophisticatedfile.best",nocase; classtype:web-application-activity; sid:300000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"talskingest.top",nocase; classtype:web-application-activity; sid:300000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tastefulwood.xyz",nocase; classtype:web-application-activity; sid:300000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tdstraffic.xyz",nocase; classtype:web-application-activity; sid:300000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theable.me",nocase; classtype:web-application-activity; sid:300000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thebettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theconnectvpn.com",nocase; classtype:web-application-activity; sid:300000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thecryptomoney.info",nocase; classtype:web-application-activity; sid:300000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefatburner.info",nocase; classtype:web-application-activity; sid:300000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thefitproject.club",nocase; classtype:web-application-activity; sid:300000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcurve.info",nocase; classtype:web-application-activity; sid:300000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthcycle.club",nocase; classtype:web-application-activity; sid:300000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthgo.info",nocase; classtype:web-application-activity; sid:300000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthpedia.info",nocase; classtype:web-application-activity; sid:300000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthystyle.info",nocase; classtype:web-application-activity; sid:300000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehealthyvibe.info",nocase; classtype:web-application-activity; sid:300000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thehotshot.info",nocase; classtype:web-application-activity; sid:300000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thenewjourney.info",nocase; classtype:web-application-activity; sid:300000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thepackage.club",nocase; classtype:web-application-activity; sid:300000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestplayerlinks.work",nocase; classtype:web-application-activity; sid:300000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thesafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"theslotomania.info",nocase; classtype:web-application-activity; sid:300000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablealwayssafeupdates.work",nocase; classtype:web-application-activity; sid:300000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thestablegreatupgrades.best",nocase; classtype:web-application-activity; sid:300000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"thrillqueen.xyz",nocase; classtype:web-application-activity; sid:300000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"toovolution.club",nocase; classtype:web-application-activity; sid:300000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"topnotchsports.tips",nocase; classtype:web-application-activity; sid:300000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficbounce.net",nocase; classtype:web-application-activity; sid:300000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficgate.cc",nocase; classtype:web-application-activity; sid:300000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trafficmind.pro",nocase; classtype:web-application-activity; sid:300000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trane.fun",nocase; classtype:web-application-activity; sid:300000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"trktraf.club",nocase; classtype:web-application-activity; sid:300000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"tryoneshot-keto.net",nocase; classtype:web-application-activity; sid:300000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uclaimrewards.net",nocase; classtype:web-application-activity; sid:300000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unequalfaucet.xyz",nocase; classtype:web-application-activity; sid:300000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"uniremedy.info",nocase; classtype:web-application-activity; sid:300000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"unitehealth.club",nocase; classtype:web-application-activity; sid:300000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatcboulevard.xyz",nocase; classtype:web-application-activity; sid:300000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmstreet.xyz",nocase; classtype:web-application-activity; sid:300000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upbeatmway.xyz",nocase; classtype:web-application-activity; sid:300000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatecurrent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thecurrentfile.best",nocase; classtype:web-application-activity; sid:300000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-thenewestfile.best",nocase; classtype:web-application-activity; sid:300000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updategreatly-therecentfile.best",nocase; classtype:web-application-activity; sid:300000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updatelatest-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"updaterecent-thegreatlyfile.best",nocase; classtype:web-application-activity; sid:300000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upmakesite.xyz",nocase; classtype:web-application-activity; sid:300000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"upplayglobal.xyz",nocase; classtype:web-application-activity; sid:300000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vexearth.xyz",nocase; classtype:web-application-activity; sid:300000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viral-surveys.win",nocase; classtype:web-application-activity; sid:300000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"viralarticles.net",nocase; classtype:web-application-activity; sid:300000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vital-health.club",nocase; classtype:web-application-activity; sid:300000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vitalrole.info",nocase; classtype:web-application-activity; sid:300000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn-pro.info",nocase; classtype:web-application-activity; sid:300000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpn1aprotectplus.com",nocase; classtype:web-application-activity; sid:300000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnadefenceplus.com",nocase; classtype:web-application-activity; sid:300000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnservice.me",nocase; classtype:web-application-activity; sid:300000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpntool.me",nocase; classtype:web-application-activity; sid:300000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"vpnupdatesnow.com",nocase; classtype:web-application-activity; sid:300000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"watchadvanced-bestgreatlyfile.best",nocase; classtype:web-application-activity; sid:300000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"watchgreatly-bestcurrentfile.best",nocase; classtype:web-application-activity; sid:300000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"watchlatest-bestgreatlyfile.best",nocase; classtype:web-application-activity; sid:300000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"website4all.info",nocase; classtype:web-application-activity; sid:300000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websiteforall.work",nocase; classtype:web-application-activity; sid:300000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"websitetoget.work",nocase; classtype:web-application-activity; sid:300000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"webtip.co",nocase; classtype:web-application-activity; sid:300000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessgram.info",nocase; classtype:web-application-activity; sid:300000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wellnessplum.info",nocase; classtype:web-application-activity; sid:300000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wherentlybrane.site",nocase; classtype:web-application-activity; sid:300000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"worldwideofficialrewardssuper.cyou",nocase; classtype:web-application-activity; sid:300000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"wowlifestyle.info",nocase; classtype:web-application-activity; sid:300000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrade.info",nocase; classtype:web-application-activity; sid:300000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrades.info",nocase; classtype:web-application-activity; sid:300000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestlinkupgrading.info",nocase; classtype:web-application-activity; sid:300000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnection.info",nocase; classtype:web-application-activity; sid:300000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbestvideoconnections.info",nocase; classtype:web-application-activity; sid:300000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayer.info",nocase; classtype:web-application-activity; sid:300000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourbettercleanplayers.info",nocase; classtype:web-application-activity; sid:300000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrade.info",nocase; classtype:web-application-activity; sid:300000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrades.info",nocase; classtype:web-application-activity; sid:300000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplaceupgrading.work",nocase; classtype:web-application-activity; sid:300000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdate.work",nocase; classtype:web-application-activity; sid:300000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryplayerupdating.work",nocase; classtype:web-application-activity; sid:300000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendarysystemsupgrade.work",nocase; classtype:web-application-activity; sid:300000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrades.info",nocase; classtype:web-application-activity; sid:300000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlegendaryvideoupgrading.info",nocase; classtype:web-application-activity; sid:300000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourlinkplaceupdatingfree.work",nocase; classtype:web-application-activity; sid:300000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestplayerlink.best",nocase; classtype:web-application-activity; sid:300000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafestreliablelink.work",nocase; classtype:web-application-activity; sid:300000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelink.info",nocase; classtype:web-application-activity; sid:300000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafeststablelinks.info",nocase; classtype:web-application-activity; sid:300000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yoursafesystemsupdating.work",nocase; classtype:web-application-activity; sid:300000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourstablegreatupdate.work",nocase; classtype:web-application-activity; sid:300000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourstablegreatupdates.work",nocase; classtype:web-application-activity; sid:300000640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourtechplaceforupgrades.info",nocase; classtype:web-application-activity; sid:300000641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"yourultimateperfectupgrades.work",nocase; classtype:web-application-activity; sid:300000642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; http_header:field host; content:"ysfetinora.tk",nocase; classtype:web-application-activity; sid:300000643; rev:1;)

744
dist/pup-filter-suricata.rules vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains Suricata Ruleset
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,165 +18,165 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"altcasino.info"; classtype:web-application-activity; sid:300000011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amateurxporn.com"; classtype:web-application-activity; sid:300000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amobil.online"; classtype:web-application-activity; sid:300000013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apptool.me"; classtype:web-application-activity; sid:300000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ashtdi.cn"; classtype:web-application-activity; sid:300000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"assuredhealth.info"; classtype:web-application-activity; sid:300000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"asufij.xyz"; classtype:web-application-activity; sid:300000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"auto-lawyer.site"; classtype:web-application-activity; sid:300000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"baseofmp3.com"; classtype:web-application-activity; sid:300000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestappland.me"; classtype:web-application-activity; sid:300000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrade.info"; classtype:web-application-activity; sid:300000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrades.info"; classtype:web-application-activity; sid:300000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrading.info"; classtype:web-application-activity; sid:300000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestresults.xyz"; classtype:web-application-activity; sid:300000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestvideoplayerupgrades.work"; classtype:web-application-activity; sid:300000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayer.info"; classtype:web-application-activity; sid:300000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayers.info"; classtype:web-application-activity; sid:300000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayer.info"; classtype:web-application-activity; sid:300000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayers.info"; classtype:web-application-activity; sid:300000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigcbd.info"; classtype:web-application-activity; sid:300000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigdaycasino.info"; classtype:web-application-activity; sid:300000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigwin-online-free-congrats.cyou"; classtype:web-application-activity; sid:300000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigwinonlinefreecongrats.cyou"; classtype:web-application-activity; sid:300000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoin-trader.me"; classtype:web-application-activity; sid:300000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoinjunction.club"; classtype:web-application-activity; sid:300000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bittrend.com"; classtype:web-application-activity; sid:300000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biztherapy.info"; classtype:web-application-activity; sid:300000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blockchain-com.email"; classtype:web-application-activity; sid:300000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyamaze.club"; classtype:web-application-activity; sid:300000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyselfcare.info"; classtype:web-application-activity; sid:300000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upcompletely-bestprecisefile.best"; classtype:web-application-activity; sid:300000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upcompletely-bestspeedyfile.best"; classtype:web-application-activity; sid:300000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upfree-bestuberfile.best"; classtype:web-application-activity; sid:300000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upoverly-bestadvancedfile.best"; classtype:web-application-activity; sid:300000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-uprefined-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upuber-bestfreefile.best"; classtype:web-application-activity; sid:300000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browsercheck.site"; classtype:web-application-activity; sid:300000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"btcinvesting.info"; classtype:web-application-activity; sid:300000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bulley.shop"; classtype:web-application-activity; sid:300000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cabins-r-us.com"; classtype:web-application-activity; sid:300000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calculateprint.xyz"; classtype:web-application-activity; sid:300000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"care-connection.info"; classtype:web-application-activity; sid:300000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carebility.info"; classtype:web-application-activity; sid:300000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"careerconnecthub.com"; classtype:web-application-activity; sid:300000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carevision.info"; classtype:web-application-activity; sid:300000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"celebseven.com"; classtype:web-application-activity; sid:300000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"centrodeartigos.com"; classtype:web-application-activity; sid:300000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"check-your-profitzone.life"; classtype:web-application-activity; sid:300000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cheerplaceweb.xyz"; classtype:web-application-activity; sid:300000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.casa"; classtype:web-application-activity; sid:300000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.cyou"; classtype:web-application-activity; sid:300000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.fun"; classtype:web-application-activity; sid:300000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.surf"; classtype:web-application-activity; sid:300000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coachbelief.xyz"; classtype:web-application-activity; sid:300000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"collectrewards.net"; classtype:web-application-activity; sid:300000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"comphp.xyz"; classtype:web-application-activity; sid:300000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceivecolor.xyz"; classtype:web-application-activity; sid:300000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conflaqpzc.info"; classtype:web-application-activity; sid:300000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"congrats-lucky-giveaway-smart.cyou"; classtype:web-application-activity; sid:300000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"congratsluckygiveawaysmart.cyou"; classtype:web-application-activity; sid:300000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"connectionapplication.com"; classtype:web-application-activity; sid:300000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.cam"; classtype:web-application-activity; sid:300000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.club"; classtype:web-application-activity; sid:300000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.fun"; classtype:web-application-activity; sid:300000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.uno"; classtype:web-application-activity; sid:300000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cooing.top"; classtype:web-application-activity; sid:300000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-alerts.xyz"; classtype:web-application-activity; sid:300000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-monitor.xyz"; classtype:web-application-activity; sid:300000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-resources.xyz"; classtype:web-application-activity; sid:300000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotilt.club"; classtype:web-application-activity; sid:300000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotradingcourses.net"; classtype:web-application-activity; sid:300000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptounlimited.info"; classtype:web-application-activity; sid:300000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cs-alerts.xyz"; classtype:web-application-activity; sid:300000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cselfconnect.com"; classtype:web-application-activity; sid:300000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curesector.today"; classtype:web-application-activity; sid:300000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.casa"; classtype:web-application-activity; sid:300000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.cyou"; classtype:web-application-activity; sid:300000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.monster"; classtype:web-application-activity; sid:300000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.site"; classtype:web-application-activity; sid:300000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.space"; classtype:web-application-activity; sid:300000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.surf"; classtype:web-application-activity; sid:300000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.work"; classtype:web-application-activity; sid:300000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailyrep.net"; classtype:web-application-activity; sid:300000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"degreenm.top"; classtype:web-application-activity; sid:300000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"delightcmain.xyz"; classtype:web-application-activity; sid:300000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digitalinvest.news"; classtype:web-application-activity; sid:300000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"displayfriend.xyz"; classtype:web-application-activity; sid:300000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ditvl.com"; classtype:web-application-activity; sid:300000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonballclub.com"; classtype:web-application-activity; sid:300000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eanswers.net"; classtype:web-application-activity; sid:300000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ehousan.top"; classtype:web-application-activity; sid:300000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eproute.info"; classtype:web-application-activity; sid:300000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eroanimeittyokusen.com"; classtype:web-application-activity; sid:300000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erotica.live"; classtype:web-application-activity; sid:300000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"excitingthing.xyz"; classtype:web-application-activity; sid:300000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrasafe.xyz"; classtype:web-application-activity; sid:300000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"facebook-sex.com"; classtype:web-application-activity; sid:300000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapc.xyz"; classtype:web-application-activity; sid:300000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapf.xyz"; classtype:web-application-activity; sid:300000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastplanetf.xyz"; classtype:web-application-activity; sid:300000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspota.xyz"; classtype:web-application-activity; sid:300000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspotb.xyz"; classtype:web-application-activity; sid:300000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastwebe.xyz"; classtype:web-application-activity; sid:300000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmesonlineturbo.net"; classtype:web-application-activity; sid:300000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmrod.xyz"; classtype:web-application-activity; sid:300000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"films-down.com"; classtype:web-application-activity; sid:300000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"financial-deals.xyz"; classtype:web-application-activity; sid:300000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findforus.net"; classtype:web-application-activity; sid:300000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findoffers.co"; classtype:web-application-activity; sid:300000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces2download.work"; classtype:web-application-activity; sid:300000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces4download.work"; classtype:web-application-activity; sid:300000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findyourultimateplayersfirst.best"; classtype:web-application-activity; sid:300000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"firststableplayer.work"; classtype:web-application-activity; sid:300000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisham.site"; classtype:web-application-activity; sid:300000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandready.info"; classtype:web-application-activity; sid:300000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandstable.club"; classtype:web-application-activity; sid:300000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitbodyandsoul.info"; classtype:web-application-activity; sid:300000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitcourage.info"; classtype:web-application-activity; sid:300000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspark.info"; classtype:web-application-activity; sid:300000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspot.club"; classtype:web-application-activity; sid:300000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthsure.info"; classtype:web-application-activity; sid:300000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitlifevalue.info"; classtype:web-application-activity; sid:300000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitnessdial.club"; classtype:web-application-activity; sid:300000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitsure.info"; classtype:web-application-activity; sid:300000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flash-rewards.info"; classtype:web-application-activity; sid:300000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flatbellylife.info"; classtype:web-application-activity; sid:300000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flexroll.online"; classtype:web-application-activity; sid:300000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flyfreecostas.live"; classtype:web-application-activity; sid:300000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foregoingpump.xyz"; classtype:web-application-activity; sid:300000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forsalecheap.net"; classtype:web-application-activity; sid:300000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"free-gifts.net"; classtype:web-application-activity; sid:300000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrade.work"; classtype:web-application-activity; sid:300000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrading.work"; classtype:web-application-activity; sid:300000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freshclover.info"; classtype:web-application-activity; sid:300000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fuck-me-hard.club"; classtype:web-application-activity; sid:300000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapc.xyz"; classtype:web-application-activity; sid:300000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapd.xyz"; classtype:web-application-activity; sid:300000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funplanetb.xyz"; classtype:web-application-activity; sid:300000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funsiteb.xyz"; classtype:web-application-activity; sid:300000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspinf.xyz"; classtype:web-application-activity; sid:300000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspotf.xyz"; classtype:web-application-activity; sid:300000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funwebd.xyz"; classtype:web-application-activity; sid:300000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fwsxqc.cn"; classtype:web-application-activity; sid:300000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gainhealth.info"; classtype:web-application-activity; sid:300000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gapingshame.xyz"; classtype:web-application-activity; sid:300000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generouscare.info"; classtype:web-application-activity; sid:300000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getmoregirls.net"; classtype:web-application-activity; sid:300000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getstablesystemupgrades.work"; classtype:web-application-activity; sid:300000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladcboulevard.xyz"; classtype:web-application-activity; sid:300000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladdboulevard.xyz"; classtype:web-application-activity; sid:300000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladmstreet.xyz"; classtype:web-application-activity; sid:300000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladplaceweb.xyz"; classtype:web-application-activity; sid:300000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladslotweb.xyz"; classtype:web-application-activity; sid:300000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspaceplane.xyz"; classtype:web-application-activity; sid:300000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotplay.xyz"; classtype:web-application-activity; sid:300000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotwonder.xyz"; classtype:web-application-activity; sid:300000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.fun"; classtype:web-application-activity; sid:300000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.online"; classtype:web-application-activity; sid:300000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.site"; classtype:web-application-activity; sid:300000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.surf"; classtype:web-application-activity; sid:300000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.website"; classtype:web-application-activity; sid:300000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"global-info.space"; classtype:web-application-activity; sid:300000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"animenation.org"; classtype:web-application-activity; sid:300000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apptool.me"; classtype:web-application-activity; sid:300000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ashtdi.cn"; classtype:web-application-activity; sid:300000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"assuredhealth.info"; classtype:web-application-activity; sid:300000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"asufij.xyz"; classtype:web-application-activity; sid:300000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"auto-lawyer.site"; classtype:web-application-activity; sid:300000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"baseofmp3.com"; classtype:web-application-activity; sid:300000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestappland.me"; classtype:web-application-activity; sid:300000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrade.info"; classtype:web-application-activity; sid:300000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrades.info"; classtype:web-application-activity; sid:300000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestlinkupgrading.info"; classtype:web-application-activity; sid:300000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestresults.xyz"; classtype:web-application-activity; sid:300000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestvideoplayerupgrades.work"; classtype:web-application-activity; sid:300000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayer.info"; classtype:web-application-activity; sid:300000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bettercleanplayers.info"; classtype:web-application-activity; sid:300000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayer.info"; classtype:web-application-activity; sid:300000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betterfreedownloadplayers.info"; classtype:web-application-activity; sid:300000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigcbd.info"; classtype:web-application-activity; sid:300000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigdaycasino.info"; classtype:web-application-activity; sid:300000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigwin-online-free-congrats.cyou"; classtype:web-application-activity; sid:300000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigwinonlinefreecongrats.cyou"; classtype:web-application-activity; sid:300000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoin-trader.me"; classtype:web-application-activity; sid:300000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bitcoinjunction.club"; classtype:web-application-activity; sid:300000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bittrend.com"; classtype:web-application-activity; sid:300000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biztherapy.info"; classtype:web-application-activity; sid:300000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blockchain-com.email"; classtype:web-application-activity; sid:300000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyamaze.club"; classtype:web-application-activity; sid:300000040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodyselfcare.info"; classtype:web-application-activity; sid:300000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upcompletely-bestprecisefile.best"; classtype:web-application-activity; sid:300000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upcompletely-bestspeedyfile.best"; classtype:web-application-activity; sid:300000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upfree-bestuberfile.best"; classtype:web-application-activity; sid:300000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upoverly-bestadvancedfile.best"; classtype:web-application-activity; sid:300000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-uprefined-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boot-upuber-bestfreefile.best"; classtype:web-application-activity; sid:300000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browsercheck.site"; classtype:web-application-activity; sid:300000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"btcinvesting.info"; classtype:web-application-activity; sid:300000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bulley.shop"; classtype:web-application-activity; sid:300000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cabins-r-us.com"; classtype:web-application-activity; sid:300000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calculateprint.xyz"; classtype:web-application-activity; sid:300000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"care-connection.info"; classtype:web-application-activity; sid:300000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carebility.info"; classtype:web-application-activity; sid:300000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"careerconnecthub.com"; classtype:web-application-activity; sid:300000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carevision.info"; classtype:web-application-activity; sid:300000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"celebseven.com"; classtype:web-application-activity; sid:300000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"centrodeartigos.com"; classtype:web-application-activity; sid:300000058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"check-your-profitzone.life"; classtype:web-application-activity; sid:300000059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cheerplaceweb.xyz"; classtype:web-application-activity; sid:300000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.casa"; classtype:web-application-activity; sid:300000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.cyou"; classtype:web-application-activity; sid:300000062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.fun"; classtype:web-application-activity; sid:300000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloudmedia.surf"; classtype:web-application-activity; sid:300000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coachbelief.xyz"; classtype:web-application-activity; sid:300000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"collectrewards.net"; classtype:web-application-activity; sid:300000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"comphp.xyz"; classtype:web-application-activity; sid:300000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceivecolor.xyz"; classtype:web-application-activity; sid:300000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conflaqpzc.info"; classtype:web-application-activity; sid:300000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"congrats-lucky-giveaway-smart.cyou"; classtype:web-application-activity; sid:300000070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"congratsluckygiveawaysmart.cyou"; classtype:web-application-activity; sid:300000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"connectionapplication.com"; classtype:web-application-activity; sid:300000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.cam"; classtype:web-application-activity; sid:300000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.club"; classtype:web-application-activity; sid:300000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.fun"; classtype:web-application-activity; sid:300000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contentgate.uno"; classtype:web-application-activity; sid:300000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cooing.top"; classtype:web-application-activity; sid:300000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-alerts.xyz"; classtype:web-application-activity; sid:300000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-monitor.xyz"; classtype:web-application-activity; sid:300000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"credit-resources.xyz"; classtype:web-application-activity; sid:300000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotilt.club"; classtype:web-application-activity; sid:300000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptotradingcourses.net"; classtype:web-application-activity; sid:300000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cryptounlimited.info"; classtype:web-application-activity; sid:300000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cs-alerts.xyz"; classtype:web-application-activity; sid:300000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cselfconnect.com"; classtype:web-application-activity; sid:300000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curesector.today"; classtype:web-application-activity; sid:300000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.casa"; classtype:web-application-activity; sid:300000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.cyou"; classtype:web-application-activity; sid:300000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.monster"; classtype:web-application-activity; sid:300000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.site"; classtype:web-application-activity; sid:300000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.space"; classtype:web-application-activity; sid:300000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.surf"; classtype:web-application-activity; sid:300000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailymedia.work"; classtype:web-application-activity; sid:300000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dailyrep.net"; classtype:web-application-activity; sid:300000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"degreenm.top"; classtype:web-application-activity; sid:300000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"delightcmain.xyz"; classtype:web-application-activity; sid:300000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digitalinvest.news"; classtype:web-application-activity; sid:300000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"displayfriend.xyz"; classtype:web-application-activity; sid:300000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ditvl.com"; classtype:web-application-activity; sid:300000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonballclub.com"; classtype:web-application-activity; sid:300000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eanswers.net"; classtype:web-application-activity; sid:300000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ehousan.top"; classtype:web-application-activity; sid:300000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eproute.info"; classtype:web-application-activity; sid:300000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eroanimeittyokusen.com"; classtype:web-application-activity; sid:300000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erotica.live"; classtype:web-application-activity; sid:300000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"excitingthing.xyz"; classtype:web-application-activity; sid:300000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrasafe.xyz"; classtype:web-application-activity; sid:300000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"facebook-sex.com"; classtype:web-application-activity; sid:300000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapc.xyz"; classtype:web-application-activity; sid:300000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastmapf.xyz"; classtype:web-application-activity; sid:300000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastplanetf.xyz"; classtype:web-application-activity; sid:300000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspota.xyz"; classtype:web-application-activity; sid:300000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastspotb.xyz"; classtype:web-application-activity; sid:300000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fastwebe.xyz"; classtype:web-application-activity; sid:300000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmesonlineturbo.net"; classtype:web-application-activity; sid:300000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"filmrod.xyz"; classtype:web-application-activity; sid:300000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"films-down.com"; classtype:web-application-activity; sid:300000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"financial-deals.xyz"; classtype:web-application-activity; sid:300000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findforus.net"; classtype:web-application-activity; sid:300000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findoffers.co"; classtype:web-application-activity; sid:300000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces2download.work"; classtype:web-application-activity; sid:300000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findperfectplaces4download.work"; classtype:web-application-activity; sid:300000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"findyourultimateplayersfirst.best"; classtype:web-application-activity; sid:300000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"firststableplayer.work"; classtype:web-application-activity; sid:300000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisham.site"; classtype:web-application-activity; sid:300000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandready.info"; classtype:web-application-activity; sid:300000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitandstable.club"; classtype:web-application-activity; sid:300000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitbodyandsoul.info"; classtype:web-application-activity; sid:300000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitcourage.info"; classtype:web-application-activity; sid:300000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspark.info"; classtype:web-application-activity; sid:300000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthspot.club"; classtype:web-application-activity; sid:300000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fithealthsure.info"; classtype:web-application-activity; sid:300000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitlifevalue.info"; classtype:web-application-activity; sid:300000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitnessdial.club"; classtype:web-application-activity; sid:300000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fitsure.info"; classtype:web-application-activity; sid:300000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flash-rewards.info"; classtype:web-application-activity; sid:300000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flatbellylife.info"; classtype:web-application-activity; sid:300000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flexroll.online"; classtype:web-application-activity; sid:300000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flyfreecostas.live"; classtype:web-application-activity; sid:300000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foregoingpump.xyz"; classtype:web-application-activity; sid:300000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forsalecheap.net"; classtype:web-application-activity; sid:300000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"free-gifts.net"; classtype:web-application-activity; sid:300000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrade.work"; classtype:web-application-activity; sid:300000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freeperfectupgrading.work"; classtype:web-application-activity; sid:300000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freshclover.info"; classtype:web-application-activity; sid:300000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fuck-me-hard.club"; classtype:web-application-activity; sid:300000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapc.xyz"; classtype:web-application-activity; sid:300000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funmapd.xyz"; classtype:web-application-activity; sid:300000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funplanetb.xyz"; classtype:web-application-activity; sid:300000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funsiteb.xyz"; classtype:web-application-activity; sid:300000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspinf.xyz"; classtype:web-application-activity; sid:300000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funspotf.xyz"; classtype:web-application-activity; sid:300000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funwebd.xyz"; classtype:web-application-activity; sid:300000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fwsxqc.cn"; classtype:web-application-activity; sid:300000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gainhealth.info"; classtype:web-application-activity; sid:300000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gapingshame.xyz"; classtype:web-application-activity; sid:300000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generouscare.info"; classtype:web-application-activity; sid:300000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getmoregirls.net"; classtype:web-application-activity; sid:300000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"getstablesystemupgrades.work"; classtype:web-application-activity; sid:300000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladcboulevard.xyz"; classtype:web-application-activity; sid:300000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladdboulevard.xyz"; classtype:web-application-activity; sid:300000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladmstreet.xyz"; classtype:web-application-activity; sid:300000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladplaceweb.xyz"; classtype:web-application-activity; sid:300000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladslotweb.xyz"; classtype:web-application-activity; sid:300000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspaceplane.xyz"; classtype:web-application-activity; sid:300000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotplay.xyz"; classtype:web-application-activity; sid:300000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladspotwonder.xyz"; classtype:web-application-activity; sid:300000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.fun"; classtype:web-application-activity; sid:300000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.online"; classtype:web-application-activity; sid:300000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.site"; classtype:web-application-activity; sid:300000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.surf"; classtype:web-application-activity; sid:300000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gladvideo.website"; classtype:web-application-activity; sid:300000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.fun"; classtype:web-application-activity; sid:300000173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"globalvideo.store"; classtype:web-application-activity; sid:300000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"go-x34n7wbcoes-ok.live"; classtype:web-application-activity; sid:300000175; rev:1;)
@ -226,42 +226,42 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"healthysure.info"; classtype:web-application-activity; sid:300000219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"httqzq.vip"; classtype:web-application-activity; sid:300000220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idtheft-alert.xyz"; classtype:web-application-activity; sid:300000221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iketo.diet"; classtype:web-application-activity; sid:300000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inappropriate.top"; classtype:web-application-activity; sid:300000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"information.casa"; classtype:web-application-activity; sid:300000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instablog.club"; classtype:web-application-activity; sid:300000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"installcompletely-theoriginalfile.best"; classtype:web-application-activity; sid:300000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"insuredhealth.info"; classtype:web-application-activity; sid:300000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosdfnc.com"; classtype:web-application-activity; sid:300000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosrecommendedvpn.com"; classtype:web-application-activity; sid:300000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosvpnsecure.com"; classtype:web-application-activity; sid:300000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"izipik.com"; classtype:web-application-activity; sid:300000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"java-forum.org"; classtype:web-application-activity; sid:300000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyplaceplay.xyz"; classtype:web-application-activity; sid:300000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotmap.xyz"; classtype:web-application-activity; sid:300000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotspin.xyz"; classtype:web-application-activity; sid:300000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jsrenthouse.com"; classtype:web-application-activity; sid:300000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jubilantdstreet.xyz"; classtype:web-application-activity; sid:300000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kad3md.cn"; classtype:web-application-activity; sid:300000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keepithealthy.info"; classtype:web-application-activity; sid:300000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketodietrecipes.org"; classtype:web-application-activity; sid:300000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leeching.net"; classtype:web-application-activity; sid:300000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrading.info"; classtype:web-application-activity; sid:300000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplayerupdates.work"; classtype:web-application-activity; sid:300000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendarysiteupgrading.work"; classtype:web-application-activity; sid:300000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrade.info"; classtype:web-application-activity; sid:300000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"life-esteem.info"; classtype:web-application-activity; sid:300000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifecaregoal.info"; classtype:web-application-activity; sid:300000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lightstop.xyz"; classtype:web-application-activity; sid:300000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livehealthcare.today"; classtype:web-application-activity; sid:300000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livelyyroad.xyz"; classtype:web-application-activity; sid:300000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livingmighty.club"; classtype:web-application-activity; sid:300000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loaddevelopeduberfile.digital"; classtype:web-application-activity; sid:300000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadfree-bestheavilyfile.best"; classtype:web-application-activity; sid:300000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inappropriate.top"; classtype:web-application-activity; sid:300000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"information.casa"; classtype:web-application-activity; sid:300000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instablog.club"; classtype:web-application-activity; sid:300000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"installcompletely-theoriginalfile.best"; classtype:web-application-activity; sid:300000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"insuredhealth.info"; classtype:web-application-activity; sid:300000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosdfnc.com"; classtype:web-application-activity; sid:300000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosrecommendedvpn.com"; classtype:web-application-activity; sid:300000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iosvpnsecure.com"; classtype:web-application-activity; sid:300000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"izipik.com"; classtype:web-application-activity; sid:300000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"java-forum.org"; classtype:web-application-activity; sid:300000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyplaceplay.xyz"; classtype:web-application-activity; sid:300000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotmap.xyz"; classtype:web-application-activity; sid:300000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joyspotspin.xyz"; classtype:web-application-activity; sid:300000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jsrenthouse.com"; classtype:web-application-activity; sid:300000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jubilantdstreet.xyz"; classtype:web-application-activity; sid:300000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kad3md.cn"; classtype:web-application-activity; sid:300000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keepithealthy.info"; classtype:web-application-activity; sid:300000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketodietrecipes.org"; classtype:web-application-activity; sid:300000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leeching.net"; classtype:web-application-activity; sid:300000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplaceupgrading.info"; classtype:web-application-activity; sid:300000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryplayerupdates.work"; classtype:web-application-activity; sid:300000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendarysiteupgrading.work"; classtype:web-application-activity; sid:300000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrade.info"; classtype:web-application-activity; sid:300000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"life-esteem.info"; classtype:web-application-activity; sid:300000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifecaregoal.info"; classtype:web-application-activity; sid:300000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lightstop.xyz"; classtype:web-application-activity; sid:300000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livehealthcare.today"; classtype:web-application-activity; sid:300000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livelyyroad.xyz"; classtype:web-application-activity; sid:300000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livingmighty.club"; classtype:web-application-activity; sid:300000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loaddevelopeduberfile.digital"; classtype:web-application-activity; sid:300000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadfree-bestheavilyfile.best"; classtype:web-application-activity; sid:300000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadfreeextremelyfile.digital"; classtype:web-application-activity; sid:300000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestadvancedfile.best"; classtype:web-application-activity; sid:300000258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestquickfile.best"; classtype:web-application-activity; sid:300000259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"loadgreatly-bestrenewedfile.best"; classtype:web-application-activity; sid:300000260; rev:1;)
@ -402,12 +402,12 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primawise.info"; classtype:web-application-activity; sid:300000395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"primecare.today"; classtype:web-application-activity; sid:300000396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"privacykeeper.net"; classtype:web-application-activity; sid:300000397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"productiq.net"; classtype:web-application-activity; sid:300000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prohealthroutine.info"; classtype:web-application-activity; sid:300000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protect-connection.com"; classtype:web-application-activity; sid:300000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prohealthroutine.info"; classtype:web-application-activity; sid:300000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protect-connection.com"; classtype:web-application-activity; sid:300000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protecttool.me"; classtype:web-application-activity; sid:300000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"protectyourvpn.com"; classtype:web-application-activity; sid:300000401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"quantum.work"; classtype:web-application-activity; sid:300000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"quickdeals.online"; classtype:web-application-activity; sid:300000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"provpnservice.me"; classtype:web-application-activity; sid:300000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"quantum.work"; classtype:web-application-activity; sid:300000403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rainlonginsect23.life"; classtype:web-application-activity; sid:300000404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"random-prize-bigwin-official.cyou"; classtype:web-application-activity; sid:300000405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"randomprizebigwinofficial.cyou"; classtype:web-application-activity; sid:300000406; rev:1;)
@ -475,172 +475,176 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detec
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shkshk.site"; classtype:web-application-activity; sid:300000468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shopnsave.world"; classtype:web-application-activity; sid:300000469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"shoppingexp.xyz"; classtype:web-application-activity; sid:300000470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetc.xyz"; classtype:web-application-activity; sid:300000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetd.xyz"; classtype:web-application-activity; sid:300000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspinb.xyz"; classtype:web-application-activity; sid:300000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspotf.xyz"; classtype:web-application-activity; sid:300000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetb.xyz"; classtype:web-application-activity; sid:300000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetf.xyz"; classtype:web-application-activity; sid:300000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitea.xyz"; classtype:web-application-activity; sid:300000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitef.xyz"; classtype:web-application-activity; sid:300000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stay-notified.cc"; classtype:web-application-activity; sid:300000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stingyscent.xyz"; classtype:web-application-activity; sid:300000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thefreefile.best"; classtype:web-application-activity; sid:300000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thequickfile.best"; classtype:web-application-activity; sid:300000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thespeedyfile.best"; classtype:web-application-activity; sid:300000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thestrongfile.best"; classtype:web-application-activity; sid:300000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storelatest-theoverlyfile.best"; classtype:web-application-activity; sid:300000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storenewest-theoverlyfile.best"; classtype:web-application-activity; sid:300000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-theadvancedfile.best"; classtype:web-application-activity; sid:300000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thecurrentfile.best"; classtype:web-application-activity; sid:300000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thelatestfile.best"; classtype:web-application-activity; sid:300000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thenewestfile.best"; classtype:web-application-activity; sid:300000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storerecent-theoverlyfile.best"; classtype:web-application-activity; sid:300000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storespeedy-theheavilyfile.best"; classtype:web-application-activity; sid:300000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeswift-theheavilyfile.best"; classtype:web-application-activity; sid:300000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamadvanced-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamadvanced-bestextremelyfile.best"; classtype:web-application-activity; sid:300000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamextremely-bestlatestfile.best"; classtype:web-application-activity; sid:300000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamextremely-bestnewestfile.best"; classtype:web-application-activity; sid:300000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamfree-bestmostfile.best"; classtype:web-application-activity; sid:300000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestadvancedfile.best"; classtype:web-application-activity; sid:300000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestcurrentfile.best"; classtype:web-application-activity; sid:300000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestlatestfile.best"; classtype:web-application-activity; sid:300000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestquickfile.best"; classtype:web-application-activity; sid:300000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamlatest-bestextremelyfile.best"; classtype:web-application-activity; sid:300000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamlatest-bestoverlyfile.best"; classtype:web-application-activity; sid:300000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamquick-bestmostfile.best"; classtype:web-application-activity; sid:300000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamrecent-bestintenselyfile.best"; classtype:web-application-activity; sid:300000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"styleandhealth.info"; classtype:web-application-activity; sid:300000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"subeamy.pw"; classtype:web-application-activity; sid:300000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sudoo.net"; classtype:web-application-activity; sid:300000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sugar-legal-about13.fun"; classtype:web-application-activity; sid:300000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superiorcare.info"; classtype:web-application-activity; sid:300000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplace4upgrade.work"; classtype:web-application-activity; sid:300000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplace4upgrading.work"; classtype:web-application-activity; sid:300000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplaceforupgrade.info"; classtype:web-application-activity; sid:300000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superpromotion.cyou"; classtype:web-application-activity; sid:300000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support-notify.space"; classtype:web-application-activity; sid:300000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-club.club"; classtype:web-application-activity; sid:300000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-review.club"; classtype:web-application-activity; sid:300000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncadvanced-bestuberfile.best"; classtype:web-application-activity; sid:300000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestoriginalfile.best"; classtype:web-application-activity; sid:300000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestrecentfile.best"; classtype:web-application-activity; sid:300000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncgreatly-bestrenewedfile.best"; classtype:web-application-activity; sid:300000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncheavily-bestlatestfile.best"; classtype:web-application-activity; sid:300000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestfreefile.best"; classtype:web-application-activity; sid:300000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestoriginalfile.best"; classtype:web-application-activity; sid:300000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestprogressivefile.best"; classtype:web-application-activity; sid:300000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestrecentfile.best"; classtype:web-application-activity; sid:300000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestspeedyfile.best"; classtype:web-application-activity; sid:300000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncintensely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synclatest-bestuberfile.best"; classtype:web-application-activity; sid:300000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncoriginal-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-besthighlyfile.best"; classtype:web-application-activity; sid:300000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncrenewed-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncstrong-bestextremelyfile.best"; classtype:web-application-activity; sid:300000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestlatestfile.best"; classtype:web-application-activity; sid:300000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestoriginalfile.best"; classtype:web-application-activity; sid:300000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprecisefile.best"; classtype:web-application-activity; sid:300000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprogressivefile.best"; classtype:web-application-activity; sid:300000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestrefinedfile.best"; classtype:web-application-activity; sid:300000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"talskingest.top"; classtype:web-application-activity; sid:300000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tastefulwood.xyz"; classtype:web-application-activity; sid:300000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tdstraffic.xyz"; classtype:web-application-activity; sid:300000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theable.me"; classtype:web-application-activity; sid:300000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayer.info"; classtype:web-application-activity; sid:300000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayers.info"; classtype:web-application-activity; sid:300000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theconnectvpn.com"; classtype:web-application-activity; sid:300000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecryptomoney.info"; classtype:web-application-activity; sid:300000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefatburner.info"; classtype:web-application-activity; sid:300000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefitproject.club"; classtype:web-application-activity; sid:300000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcurve.info"; classtype:web-application-activity; sid:300000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcycle.club"; classtype:web-application-activity; sid:300000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthgo.info"; classtype:web-application-activity; sid:300000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthpedia.info"; classtype:web-application-activity; sid:300000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthystyle.info"; classtype:web-application-activity; sid:300000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthyvibe.info"; classtype:web-application-activity; sid:300000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehotshot.info"; classtype:web-application-activity; sid:300000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thelastpicture.show"; classtype:web-application-activity; sid:300000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thenewjourney.info"; classtype:web-application-activity; sid:300000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thepackage.club"; classtype:web-application-activity; sid:300000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestplayerlinks.work"; classtype:web-application-activity; sid:300000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestreliablelink.work"; classtype:web-application-activity; sid:300000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theslotomania.info"; classtype:web-application-activity; sid:300000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablealwayssafeupdates.work"; classtype:web-application-activity; sid:300000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupdates.work"; classtype:web-application-activity; sid:300000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupgrades.best"; classtype:web-application-activity; sid:300000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thrillqueen.xyz"; classtype:web-application-activity; sid:300000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toovolution.club"; classtype:web-application-activity; sid:300000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topnotchsports.tips"; classtype:web-application-activity; sid:300000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficbounce.net"; classtype:web-application-activity; sid:300000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficgate.cc"; classtype:web-application-activity; sid:300000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trane.fun"; classtype:web-application-activity; sid:300000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trktraf.club"; classtype:web-application-activity; sid:300000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tryoneshot-keto.net"; classtype:web-application-activity; sid:300000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uclaimrewards.net"; classtype:web-application-activity; sid:300000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unequalfaucet.xyz"; classtype:web-application-activity; sid:300000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uniremedy.info"; classtype:web-application-activity; sid:300000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unitehealth.club"; classtype:web-application-activity; sid:300000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatcboulevard.xyz"; classtype:web-application-activity; sid:300000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmstreet.xyz"; classtype:web-application-activity; sid:300000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmway.xyz"; classtype:web-application-activity; sid:300000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatecurrent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thecurrentfile.best"; classtype:web-application-activity; sid:300000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thenewestfile.best"; classtype:web-application-activity; sid:300000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-therecentfile.best"; classtype:web-application-activity; sid:300000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatelatest-thegreatlyfile.best"; classtype:web-application-activity; sid:300000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updaterecent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upmakesite.xyz"; classtype:web-application-activity; sid:300000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upplayglobal.xyz"; classtype:web-application-activity; sid:300000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vexearth.xyz"; classtype:web-application-activity; sid:300000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viral-surveys.win"; classtype:web-application-activity; sid:300000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viralarticles.net"; classtype:web-application-activity; sid:300000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vital-health.club"; classtype:web-application-activity; sid:300000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vitalrole.info"; classtype:web-application-activity; sid:300000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn-pro.info"; classtype:web-application-activity; sid:300000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn1aprotectplus.com"; classtype:web-application-activity; sid:300000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnadefenceplus.com"; classtype:web-application-activity; sid:300000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnservice.me"; classtype:web-application-activity; sid:300000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpntool.me"; classtype:web-application-activity; sid:300000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnupdatesnow.com"; classtype:web-application-activity; sid:300000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"watchadvanced-bestgreatlyfile.best"; classtype:web-application-activity; sid:300000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"website4all.info"; classtype:web-application-activity; sid:300000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websiteforall.work"; classtype:web-application-activity; sid:300000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websitetoget.work"; classtype:web-application-activity; sid:300000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"webtip.co"; classtype:web-application-activity; sid:300000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessgram.info"; classtype:web-application-activity; sid:300000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessplum.info"; classtype:web-application-activity; sid:300000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wherentlybrane.site"; classtype:web-application-activity; sid:300000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"worldwideofficialrewardssuper.cyou"; classtype:web-application-activity; sid:300000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wowlifestyle.info"; classtype:web-application-activity; sid:300000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrade.info"; classtype:web-application-activity; sid:300000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrades.info"; classtype:web-application-activity; sid:300000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrading.info"; classtype:web-application-activity; sid:300000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnection.info"; classtype:web-application-activity; sid:300000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnections.info"; classtype:web-application-activity; sid:300000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayer.info"; classtype:web-application-activity; sid:300000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayers.info"; classtype:web-application-activity; sid:300000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrading.work"; classtype:web-application-activity; sid:300000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdate.work"; classtype:web-application-activity; sid:300000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdating.work"; classtype:web-application-activity; sid:300000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendarysystemsupgrade.work"; classtype:web-application-activity; sid:300000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlinkplaceupdatingfree.work"; classtype:web-application-activity; sid:300000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestplayerlink.best"; classtype:web-application-activity; sid:300000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestreliablelink.work"; classtype:web-application-activity; sid:300000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelink.info"; classtype:web-application-activity; sid:300000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelinks.info"; classtype:web-application-activity; sid:300000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafesystemsupdating.work"; classtype:web-application-activity; sid:300000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourstablegreatupdate.work"; classtype:web-application-activity; sid:300000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourstablegreatupdates.work"; classtype:web-application-activity; sid:300000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourtechplaceforupgrades.info"; classtype:web-application-activity; sid:300000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourultimateperfectupgrades.work"; classtype:web-application-activity; sid:300000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ysfetinora.tk"; classtype:web-application-activity; sid:300000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"signupandturnyourscreenoffsafepowernow.date"; classtype:web-application-activity; sid:300000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetc.xyz"; classtype:web-application-activity; sid:300000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotplanetd.xyz"; classtype:web-application-activity; sid:300000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspinb.xyz"; classtype:web-application-activity; sid:300000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spotspotf.xyz"; classtype:web-application-activity; sid:300000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetb.xyz"; classtype:web-application-activity; sid:300000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springplanetf.xyz"; classtype:web-application-activity; sid:300000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitea.xyz"; classtype:web-application-activity; sid:300000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springsitef.xyz"; classtype:web-application-activity; sid:300000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stay-notified.cc"; classtype:web-application-activity; sid:300000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stingyscent.xyz"; classtype:web-application-activity; sid:300000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thefreefile.best"; classtype:web-application-activity; sid:300000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thequickfile.best"; classtype:web-application-activity; sid:300000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thespeedyfile.best"; classtype:web-application-activity; sid:300000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeheavily-thestrongfile.best"; classtype:web-application-activity; sid:300000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storelatest-theoverlyfile.best"; classtype:web-application-activity; sid:300000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storenewest-theoverlyfile.best"; classtype:web-application-activity; sid:300000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-theadvancedfile.best"; classtype:web-application-activity; sid:300000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thecurrentfile.best"; classtype:web-application-activity; sid:300000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thelatestfile.best"; classtype:web-application-activity; sid:300000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeoverly-thenewestfile.best"; classtype:web-application-activity; sid:300000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storerecent-theoverlyfile.best"; classtype:web-application-activity; sid:300000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storespeedy-theheavilyfile.best"; classtype:web-application-activity; sid:300000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"storeswift-theheavilyfile.best"; classtype:web-application-activity; sid:300000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamadvanced-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamadvanced-bestextremelyfile.best"; classtype:web-application-activity; sid:300000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamextremely-bestlatestfile.best"; classtype:web-application-activity; sid:300000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamextremely-bestnewestfile.best"; classtype:web-application-activity; sid:300000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamfree-bestmostfile.best"; classtype:web-application-activity; sid:300000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestadvancedfile.best"; classtype:web-application-activity; sid:300000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestcurrentfile.best"; classtype:web-application-activity; sid:300000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestlatestfile.best"; classtype:web-application-activity; sid:300000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamintensely-bestquickfile.best"; classtype:web-application-activity; sid:300000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamlatest-bestextremelyfile.best"; classtype:web-application-activity; sid:300000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamlatest-bestoverlyfile.best"; classtype:web-application-activity; sid:300000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamquick-bestmostfile.best"; classtype:web-application-activity; sid:300000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streamrecent-bestintenselyfile.best"; classtype:web-application-activity; sid:300000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"studentslearnintogether.club"; classtype:web-application-activity; sid:300000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"styleandhealth.info"; classtype:web-application-activity; sid:300000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"subeamy.pw"; classtype:web-application-activity; sid:300000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sudoo.net"; classtype:web-application-activity; sid:300000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sugar-legal-about13.fun"; classtype:web-application-activity; sid:300000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superiorcare.info"; classtype:web-application-activity; sid:300000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplace4upgrade.work"; classtype:web-application-activity; sid:300000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplace4upgrading.work"; classtype:web-application-activity; sid:300000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superplaceforupgrade.info"; classtype:web-application-activity; sid:300000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"superpromotion.cyou"; classtype:web-application-activity; sid:300000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support-notify.space"; classtype:web-application-activity; sid:300000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-club.club"; classtype:web-application-activity; sid:300000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"survey-review.club"; classtype:web-application-activity; sid:300000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncadvanced-bestuberfile.best"; classtype:web-application-activity; sid:300000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestoriginalfile.best"; classtype:web-application-activity; sid:300000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synccompletely-bestrecentfile.best"; classtype:web-application-activity; sid:300000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncgreatly-bestrenewedfile.best"; classtype:web-application-activity; sid:300000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncheavily-bestlatestfile.best"; classtype:web-application-activity; sid:300000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestfreefile.best"; classtype:web-application-activity; sid:300000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestoriginalfile.best"; classtype:web-application-activity; sid:300000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestprogressivefile.best"; classtype:web-application-activity; sid:300000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestrecentfile.best"; classtype:web-application-activity; sid:300000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synchighly-bestspeedyfile.best"; classtype:web-application-activity; sid:300000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncintensely-bestprogressivefile.best"; classtype:web-application-activity; sid:300000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"synclatest-bestuberfile.best"; classtype:web-application-activity; sid:300000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncoriginal-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncprogressive-besthighlyfile.best"; classtype:web-application-activity; sid:300000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncrenewed-bestcompletelyfile.best"; classtype:web-application-activity; sid:300000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncstrong-bestextremelyfile.best"; classtype:web-application-activity; sid:300000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestlatestfile.best"; classtype:web-application-activity; sid:300000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestoriginalfile.best"; classtype:web-application-activity; sid:300000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprecisefile.best"; classtype:web-application-activity; sid:300000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestprogressivefile.best"; classtype:web-application-activity; sid:300000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestrefinedfile.best"; classtype:web-application-activity; sid:300000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syncuber-bestsophisticatedfile.best"; classtype:web-application-activity; sid:300000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"talskingest.top"; classtype:web-application-activity; sid:300000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tastefulwood.xyz"; classtype:web-application-activity; sid:300000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tdstraffic.xyz"; classtype:web-application-activity; sid:300000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theable.me"; classtype:web-application-activity; sid:300000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayer.info"; classtype:web-application-activity; sid:300000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thebettercleanplayers.info"; classtype:web-application-activity; sid:300000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theconnectvpn.com"; classtype:web-application-activity; sid:300000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecryptomoney.info"; classtype:web-application-activity; sid:300000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefatburner.info"; classtype:web-application-activity; sid:300000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefitproject.club"; classtype:web-application-activity; sid:300000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcurve.info"; classtype:web-application-activity; sid:300000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthcycle.club"; classtype:web-application-activity; sid:300000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthgo.info"; classtype:web-application-activity; sid:300000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthpedia.info"; classtype:web-application-activity; sid:300000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthystyle.info"; classtype:web-application-activity; sid:300000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehealthyvibe.info"; classtype:web-application-activity; sid:300000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehotshot.info"; classtype:web-application-activity; sid:300000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thenewjourney.info"; classtype:web-application-activity; sid:300000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thepackage.club"; classtype:web-application-activity; sid:300000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestplayerlinks.work"; classtype:web-application-activity; sid:300000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesafestreliablelink.work"; classtype:web-application-activity; sid:300000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theslotomania.info"; classtype:web-application-activity; sid:300000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablealwayssafeupdates.work"; classtype:web-application-activity; sid:300000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupdates.work"; classtype:web-application-activity; sid:300000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thestablegreatupgrades.best"; classtype:web-application-activity; sid:300000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thrillqueen.xyz"; classtype:web-application-activity; sid:300000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toovolution.club"; classtype:web-application-activity; sid:300000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topnotchsports.tips"; classtype:web-application-activity; sid:300000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficbounce.net"; classtype:web-application-activity; sid:300000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficgate.cc"; classtype:web-application-activity; sid:300000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trafficmind.pro"; classtype:web-application-activity; sid:300000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trane.fun"; classtype:web-application-activity; sid:300000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"trktraf.club"; classtype:web-application-activity; sid:300000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tryoneshot-keto.net"; classtype:web-application-activity; sid:300000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uclaimrewards.net"; classtype:web-application-activity; sid:300000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unequalfaucet.xyz"; classtype:web-application-activity; sid:300000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uniremedy.info"; classtype:web-application-activity; sid:300000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unitehealth.club"; classtype:web-application-activity; sid:300000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatcboulevard.xyz"; classtype:web-application-activity; sid:300000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmstreet.xyz"; classtype:web-application-activity; sid:300000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upbeatmway.xyz"; classtype:web-application-activity; sid:300000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatecurrent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thecurrentfile.best"; classtype:web-application-activity; sid:300000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-thenewestfile.best"; classtype:web-application-activity; sid:300000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updategreatly-therecentfile.best"; classtype:web-application-activity; sid:300000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updatelatest-thegreatlyfile.best"; classtype:web-application-activity; sid:300000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"updaterecent-thegreatlyfile.best"; classtype:web-application-activity; sid:300000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upmakesite.xyz"; classtype:web-application-activity; sid:300000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upplayglobal.xyz"; classtype:web-application-activity; sid:300000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vexearth.xyz"; classtype:web-application-activity; sid:300000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viral-surveys.win"; classtype:web-application-activity; sid:300000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"viralarticles.net"; classtype:web-application-activity; sid:300000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vital-health.club"; classtype:web-application-activity; sid:300000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vitalrole.info"; classtype:web-application-activity; sid:300000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn-pro.info"; classtype:web-application-activity; sid:300000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpn1aprotectplus.com"; classtype:web-application-activity; sid:300000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnadefenceplus.com"; classtype:web-application-activity; sid:300000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnservice.me"; classtype:web-application-activity; sid:300000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpntool.me"; classtype:web-application-activity; sid:300000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vpnupdatesnow.com"; classtype:web-application-activity; sid:300000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"watchadvanced-bestgreatlyfile.best"; classtype:web-application-activity; sid:300000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"watchgreatly-bestcurrentfile.best"; classtype:web-application-activity; sid:300000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"watchlatest-bestgreatlyfile.best"; classtype:web-application-activity; sid:300000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"website4all.info"; classtype:web-application-activity; sid:300000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websiteforall.work"; classtype:web-application-activity; sid:300000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"websitetoget.work"; classtype:web-application-activity; sid:300000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"webtip.co"; classtype:web-application-activity; sid:300000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessgram.info"; classtype:web-application-activity; sid:300000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wellnessplum.info"; classtype:web-application-activity; sid:300000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wherentlybrane.site"; classtype:web-application-activity; sid:300000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"worldwideofficialrewardssuper.cyou"; classtype:web-application-activity; sid:300000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wowlifestyle.info"; classtype:web-application-activity; sid:300000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrade.info"; classtype:web-application-activity; sid:300000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrades.info"; classtype:web-application-activity; sid:300000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestlinkupgrading.info"; classtype:web-application-activity; sid:300000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnection.info"; classtype:web-application-activity; sid:300000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbestvideoconnections.info"; classtype:web-application-activity; sid:300000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayer.info"; classtype:web-application-activity; sid:300000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourbettercleanplayers.info"; classtype:web-application-activity; sid:300000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrade.info"; classtype:web-application-activity; sid:300000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrades.info"; classtype:web-application-activity; sid:300000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplaceupgrading.work"; classtype:web-application-activity; sid:300000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdate.work"; classtype:web-application-activity; sid:300000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryplayerupdating.work"; classtype:web-application-activity; sid:300000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendarysystemsupgrade.work"; classtype:web-application-activity; sid:300000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrades.info"; classtype:web-application-activity; sid:300000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlegendaryvideoupgrading.info"; classtype:web-application-activity; sid:300000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourlinkplaceupdatingfree.work"; classtype:web-application-activity; sid:300000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestplayerlink.best"; classtype:web-application-activity; sid:300000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafestreliablelink.work"; classtype:web-application-activity; sid:300000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelink.info"; classtype:web-application-activity; sid:300000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafeststablelinks.info"; classtype:web-application-activity; sid:300000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoursafesystemsupdating.work"; classtype:web-application-activity; sid:300000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourstablegreatupdate.work"; classtype:web-application-activity; sid:300000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourstablegreatupdates.work"; classtype:web-application-activity; sid:300000640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourtechplaceforupgrades.info"; classtype:web-application-activity; sid:300000641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yourultimateperfectupgrades.work"; classtype:web-application-activity; sid:300000642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"pup-filter PUP website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ysfetinora.tk"; classtype:web-application-activity; sid:300000643; rev:1;)

16
dist/pup-filter-unbound.conf vendored
View File

@ -1,6 +1,6 @@
# Title: PUP Domains Unbound Blocklist
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@ local-zone: "akb48wrapup.com" always_nxdomain
local-zone: "altcasino.info" always_nxdomain
local-zone: "amateurxporn.com" always_nxdomain
local-zone: "amobil.online" always_nxdomain
local-zone: "animenation.org" always_nxdomain
local-zone: "apptool.me" always_nxdomain
local-zone: "ashtdi.cn" always_nxdomain
local-zone: "assuredhealth.info" always_nxdomain
@ -176,7 +177,6 @@ local-zone: "gladvideo.online" always_nxdomain
local-zone: "gladvideo.site" always_nxdomain
local-zone: "gladvideo.surf" always_nxdomain
local-zone: "gladvideo.website" always_nxdomain
local-zone: "global-info.space" always_nxdomain
local-zone: "globalvideo.fun" always_nxdomain
local-zone: "globalvideo.store" always_nxdomain
local-zone: "go-x34n7wbcoes-ok.live" always_nxdomain
@ -226,7 +226,6 @@ local-zone: "healthyspirit.info" always_nxdomain
local-zone: "healthysure.info" always_nxdomain
local-zone: "httqzq.vip" always_nxdomain
local-zone: "idtheft-alert.xyz" always_nxdomain
local-zone: "iketo.diet" always_nxdomain
local-zone: "inappropriate.top" always_nxdomain
local-zone: "information.casa" always_nxdomain
local-zone: "instablog.club" always_nxdomain
@ -262,6 +261,7 @@ local-zone: "livelyyroad.xyz" always_nxdomain
local-zone: "livingmighty.club" always_nxdomain
local-zone: "loaddevelopeduberfile.digital" always_nxdomain
local-zone: "loadfree-bestheavilyfile.best" always_nxdomain
local-zone: "loadfreeextremelyfile.digital" always_nxdomain
local-zone: "loadgreatly-bestadvancedfile.best" always_nxdomain
local-zone: "loadgreatly-bestquickfile.best" always_nxdomain
local-zone: "loadgreatly-bestrenewedfile.best" always_nxdomain
@ -402,12 +402,12 @@ local-zone: "preparedforsafeupgrading.work" always_nxdomain
local-zone: "primawise.info" always_nxdomain
local-zone: "primecare.today" always_nxdomain
local-zone: "privacykeeper.net" always_nxdomain
local-zone: "productiq.net" always_nxdomain
local-zone: "prohealthroutine.info" always_nxdomain
local-zone: "protect-connection.com" always_nxdomain
local-zone: "protecttool.me" always_nxdomain
local-zone: "protectyourvpn.com" always_nxdomain
local-zone: "provpnservice.me" always_nxdomain
local-zone: "quantum.work" always_nxdomain
local-zone: "quickdeals.online" always_nxdomain
local-zone: "rainlonginsect23.life" always_nxdomain
local-zone: "random-prize-bigwin-official.cyou" always_nxdomain
local-zone: "randomprizebigwinofficial.cyou" always_nxdomain
@ -475,6 +475,7 @@ local-zone: "service-care.space" always_nxdomain
local-zone: "shkshk.site" always_nxdomain
local-zone: "shopnsave.world" always_nxdomain
local-zone: "shoppingexp.xyz" always_nxdomain
local-zone: "signupandturnyourscreenoffsafepowernow.date" always_nxdomain
local-zone: "spotplanetc.xyz" always_nxdomain
local-zone: "spotplanetd.xyz" always_nxdomain
local-zone: "spotspinb.xyz" always_nxdomain
@ -511,6 +512,7 @@ local-zone: "streamlatest-bestextremelyfile.best" always_nxdomain
local-zone: "streamlatest-bestoverlyfile.best" always_nxdomain
local-zone: "streamquick-bestmostfile.best" always_nxdomain
local-zone: "streamrecent-bestintenselyfile.best" always_nxdomain
local-zone: "studentslearnintogether.club" always_nxdomain
local-zone: "styleandhealth.info" always_nxdomain
local-zone: "subeamy.pw" always_nxdomain
local-zone: "sudoo.net" always_nxdomain
@ -565,7 +567,6 @@ local-zone: "thehealthpedia.info" always_nxdomain
local-zone: "thehealthystyle.info" always_nxdomain
local-zone: "thehealthyvibe.info" always_nxdomain
local-zone: "thehotshot.info" always_nxdomain
local-zone: "thelastpicture.show" always_nxdomain
local-zone: "thenewjourney.info" always_nxdomain
local-zone: "thepackage.club" always_nxdomain
local-zone: "thesafestplayerlinks.work" always_nxdomain
@ -579,6 +580,7 @@ local-zone: "toovolution.club" always_nxdomain
local-zone: "topnotchsports.tips" always_nxdomain
local-zone: "trafficbounce.net" always_nxdomain
local-zone: "trafficgate.cc" always_nxdomain
local-zone: "trafficmind.pro" always_nxdomain
local-zone: "trane.fun" always_nxdomain
local-zone: "trktraf.club" always_nxdomain
local-zone: "tryoneshot-keto.net" always_nxdomain
@ -609,6 +611,8 @@ local-zone: "vpnservice.me" always_nxdomain
local-zone: "vpntool.me" always_nxdomain
local-zone: "vpnupdatesnow.com" always_nxdomain
local-zone: "watchadvanced-bestgreatlyfile.best" always_nxdomain
local-zone: "watchgreatly-bestcurrentfile.best" always_nxdomain
local-zone: "watchlatest-bestgreatlyfile.best" always_nxdomain
local-zone: "website4all.info" always_nxdomain
local-zone: "websiteforall.work" always_nxdomain
local-zone: "websitetoget.work" always_nxdomain

16
dist/pup-filter-vivaldi.txt vendored
View File

@ -1,6 +1,6 @@
! Title: PUP Domains Blocklist (Vivaldi)
! Description: Block domains that host potentially unwanted programs (PUP)
! Updated: Tue, 25 May 2021 12:06:53 UTC
! Updated: Wed, 26 May 2021 00:07:00 UTC
! Expires: 1 day (update frequency)
! Homepage: https://gitlab.com/curben/pup-filter
! License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@
||altcasino.info$document
||amateurxporn.com$document
||amobil.online$document
||animenation.org$document
||apptool.me$document
||ashtdi.cn$document
||assuredhealth.info$document
@ -176,7 +177,6 @@
||gladvideo.site$document
||gladvideo.surf$document
||gladvideo.website$document
||global-info.space$document
||globalvideo.fun$document
||globalvideo.store$document
||go-x34n7wbcoes-ok.live$document
@ -226,7 +226,6 @@
||healthysure.info$document
||httqzq.vip$document
||idtheft-alert.xyz$document
||iketo.diet$document
||inappropriate.top$document
||information.casa$document
||instablog.club$document
@ -262,6 +261,7 @@
||livingmighty.club$document
||loaddevelopeduberfile.digital$document
||loadfree-bestheavilyfile.best$document
||loadfreeextremelyfile.digital$document
||loadgreatly-bestadvancedfile.best$document
||loadgreatly-bestquickfile.best$document
||loadgreatly-bestrenewedfile.best$document
@ -402,12 +402,12 @@
||primawise.info$document
||primecare.today$document
||privacykeeper.net$document
||productiq.net$document
||prohealthroutine.info$document
||protect-connection.com$document
||protecttool.me$document
||protectyourvpn.com$document
||provpnservice.me$document
||quantum.work$document
||quickdeals.online$document
||rainlonginsect23.life$document
||random-prize-bigwin-official.cyou$document
||randomprizebigwinofficial.cyou$document
@ -475,6 +475,7 @@
||shkshk.site$document
||shopnsave.world$document
||shoppingexp.xyz$document
||signupandturnyourscreenoffsafepowernow.date$document
||spotplanetc.xyz$document
||spotplanetd.xyz$document
||spotspinb.xyz$document
@ -511,6 +512,7 @@
||streamlatest-bestoverlyfile.best$document
||streamquick-bestmostfile.best$document
||streamrecent-bestintenselyfile.best$document
||studentslearnintogether.club$document
||styleandhealth.info$document
||subeamy.pw$document
||sudoo.net$document
@ -565,7 +567,6 @@
||thehealthystyle.info$document
||thehealthyvibe.info$document
||thehotshot.info$document
||thelastpicture.show$document
||thenewjourney.info$document
||thepackage.club$document
||thesafestplayerlinks.work$document
@ -579,6 +580,7 @@
||topnotchsports.tips$document
||trafficbounce.net$document
||trafficgate.cc$document
||trafficmind.pro$document
||trane.fun$document
||trktraf.club$document
||tryoneshot-keto.net$document
@ -609,6 +611,8 @@
||vpntool.me$document
||vpnupdatesnow.com$document
||watchadvanced-bestgreatlyfile.best$document
||watchgreatly-bestcurrentfile.best$document
||watchlatest-bestgreatlyfile.best$document
||website4all.info$document
||websiteforall.work$document
||websitetoget.work$document

16
dist/pup-filter.tpl vendored
View File

@ -1,7 +1,7 @@
msFilterList
# Title: PUP Hosts Blocklist (IE)
# Description: Block domains that host potentially unwanted programs (PUP)
# Updated: Tue, 25 May 2021 12:06:53 UTC
# Updated: Wed, 26 May 2021 00:07:00 UTC
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/pup-filter
# License: https://gitlab.com/curben/pup-filter#license
@ -21,6 +21,7 @@ msFilterList
-d altcasino.info
-d amateurxporn.com
-d amobil.online
-d animenation.org
-d apptool.me
-d ashtdi.cn
-d assuredhealth.info
@ -179,7 +180,6 @@ msFilterList
-d gladvideo.site
-d gladvideo.surf
-d gladvideo.website
-d global-info.space
-d globalvideo.fun
-d globalvideo.store
-d go-x34n7wbcoes-ok.live
@ -229,7 +229,6 @@ msFilterList
-d healthysure.info
-d httqzq.vip
-d idtheft-alert.xyz
-d iketo.diet
-d inappropriate.top
-d information.casa
-d instablog.club
@ -265,6 +264,7 @@ msFilterList
-d livingmighty.club
-d loaddevelopeduberfile.digital
-d loadfree-bestheavilyfile.best
-d loadfreeextremelyfile.digital
-d loadgreatly-bestadvancedfile.best
-d loadgreatly-bestquickfile.best
-d loadgreatly-bestrenewedfile.best
@ -405,12 +405,12 @@ msFilterList
-d primawise.info
-d primecare.today
-d privacykeeper.net
-d productiq.net
-d prohealthroutine.info
-d protect-connection.com
-d protecttool.me
-d protectyourvpn.com
-d provpnservice.me
-d quantum.work
-d quickdeals.online
-d rainlonginsect23.life
-d random-prize-bigwin-official.cyou
-d randomprizebigwinofficial.cyou
@ -478,6 +478,7 @@ msFilterList
-d shkshk.site
-d shopnsave.world
-d shoppingexp.xyz
-d signupandturnyourscreenoffsafepowernow.date
-d spotplanetc.xyz
-d spotplanetd.xyz
-d spotspinb.xyz
@ -514,6 +515,7 @@ msFilterList
-d streamlatest-bestoverlyfile.best
-d streamquick-bestmostfile.best
-d streamrecent-bestintenselyfile.best
-d studentslearnintogether.club
-d styleandhealth.info
-d subeamy.pw
-d sudoo.net
@ -568,7 +570,6 @@ msFilterList
-d thehealthystyle.info
-d thehealthyvibe.info
-d thehotshot.info
-d thelastpicture.show
-d thenewjourney.info
-d thepackage.club
-d thesafestplayerlinks.work
@ -582,6 +583,7 @@ msFilterList
-d topnotchsports.tips
-d trafficbounce.net
-d trafficgate.cc
-d trafficmind.pro
-d trane.fun
-d trktraf.club
-d tryoneshot-keto.net
@ -612,6 +614,8 @@ msFilterList
-d vpntool.me
-d vpnupdatesnow.com
-d watchadvanced-bestgreatlyfile.best
-d watchgreatly-bestcurrentfile.best
-d watchlatest-bestgreatlyfile.best
-d website4all.info
-d websiteforall.work
-d websitetoget.work

16
dist/pup-filter.txt vendored
View File

@ -1,6 +1,6 @@
! Title: PUP Domains Blocklist
! Description: Block domains that host potentially unwanted programs (PUP)
! Updated: Tue, 25 May 2021 12:06:53 UTC
! Updated: Wed, 26 May 2021 00:07:00 UTC
! Expires: 1 day (update frequency)
! Homepage: https://gitlab.com/curben/pup-filter
! License: https://gitlab.com/curben/pup-filter#license
@ -18,6 +18,7 @@ akb48wrapup.com
altcasino.info
amateurxporn.com
amobil.online
animenation.org
apptool.me
ashtdi.cn
assuredhealth.info
@ -176,7 +177,6 @@ gladvideo.online
gladvideo.site
gladvideo.surf
gladvideo.website
global-info.space
globalvideo.fun
globalvideo.store
go-x34n7wbcoes-ok.live
@ -226,7 +226,6 @@ healthyspirit.info
healthysure.info
httqzq.vip
idtheft-alert.xyz
iketo.diet
inappropriate.top
information.casa
instablog.club
@ -262,6 +261,7 @@ livelyyroad.xyz
livingmighty.club
loaddevelopeduberfile.digital
loadfree-bestheavilyfile.best
loadfreeextremelyfile.digital
loadgreatly-bestadvancedfile.best
loadgreatly-bestquickfile.best
loadgreatly-bestrenewedfile.best
@ -402,12 +402,12 @@ preparedforsafeupgrading.work
primawise.info
primecare.today
privacykeeper.net
productiq.net
prohealthroutine.info
protect-connection.com
protecttool.me
protectyourvpn.com
provpnservice.me
quantum.work
quickdeals.online
rainlonginsect23.life
random-prize-bigwin-official.cyou
randomprizebigwinofficial.cyou
@ -475,6 +475,7 @@ service-care.space
shkshk.site
shopnsave.world
shoppingexp.xyz
signupandturnyourscreenoffsafepowernow.date
spotplanetc.xyz
spotplanetd.xyz
spotspinb.xyz
@ -511,6 +512,7 @@ streamlatest-bestextremelyfile.best
streamlatest-bestoverlyfile.best
streamquick-bestmostfile.best
streamrecent-bestintenselyfile.best
studentslearnintogether.club
styleandhealth.info
subeamy.pw
sudoo.net
@ -565,7 +567,6 @@ thehealthpedia.info
thehealthystyle.info
thehealthyvibe.info
thehotshot.info
thelastpicture.show
thenewjourney.info
thepackage.club
thesafestplayerlinks.work
@ -579,6 +580,7 @@ toovolution.club
topnotchsports.tips
trafficbounce.net
trafficgate.cc
trafficmind.pro
trane.fun
trktraf.club
tryoneshot-keto.net
@ -609,6 +611,8 @@ vpnservice.me
vpntool.me
vpnupdatesnow.com
watchadvanced-bestgreatlyfile.best
watchgreatly-bestcurrentfile.best
watchlatest-bestgreatlyfile.best
website4all.info
websiteforall.work
websitetoget.work